ICAM and MFA Fundamentals

A foundational course on Identity, Credential, and Access Management for anyone who needs to understand the identity layer without becoming an identity engineer. It runs the full chain in order — identity, proofing, authentication and MFA, authorization, federation, and finally the access decision itself — so each piece arrives with the previous one already in place.

This course explains which MFA methods to use, and why. Rather than treating multifactor as one checkbox, it separates the authenticator types, sets out the assurance levels behind them, and works through the attacks aimed squarely at MFA: phishing, MFA fatigue, credential theft, and adversary-in-the-middle. Participants finish able to explain why a push notification and a hardware security key are not equivalent controls. The closing module is applied. Participants work short scenario exercises framed as "Should this user get access?", pulling identity, credential, authentication, and authorization together into a single judgment, the way a Zero Trust access decision is actually made. Across the course participants work with the IAL, AAL, and FAL assurance-level model, PIV and other hardware-backed credentials, Zero Trust access decisions, RBAC and ABAC, and an introduction to SAML, OAuth, and OpenID Connect.

What You Will Learn

• Distinguish identity, account, credential, and authenticator, and explain how identity, authentication, authorization, and access relate to each other
• Explain identity proofing and the joiner, mover, and leaver lifecycle, including provisioning, revocation, and termination
• Apply the assurance-level model, IAL, AAL, and FAL, to real access situations
• Compare common MFA methods and explain why stronger methods provide greater assurance
• Recognize attacks aimed at MFA, including phishing, MFA fatigue, credential theft, and adversary-in-the-middle
• Apply least privilege, need-to-know, role-based access control, and attribute-based access control to authorization decisions
• Explain federation and single sign-on, including identity providers, relying parties, credentials, and assertions
• Work a full access transaction end to end and judge whether a given user should be granted access

Course Outline

Module 1

• Identity Is the New Perimeter: ICAM Foundations
• What ICAM means
• Identity versus account versus credential versus authenticator
• Human and non-person identities
• Why ICAM is foundational
• ICAM's role in Zero Trust

Module 2

• Who Are You? Identity Proofing and the Identity Lifecycle
• Proofing and enrollment
• Establishing confidence in a claimed identity
• Identity Assurance Levels
• Provisioning
• Joiner, mover, and leaver
• Authoritative sources
• Disabling, revocation, and termination

Module 3

• Prove It: Authentication and MFA Essentials
• Identification versus authentication
• The three factor types
• Single-factor versus MFA
• Multi-factor authenticators versus multiple authenticators
• Passwords, OTPs, cryptographic authenticators, and biometrics
• AAL1, AAL2, and AAL3
• Phishing-resistant authentication

Module 4

• Beyond the Password: MFA Technologies and Threats
• Authenticator apps and one-time passcodes
• Push-based authentication
• Smart cards and cryptographic credentials
• PIV credentials in federal environments
• Biometrics
• Phishing, MFA fatigue, credential theft, and adversary-in-the-middle attacks

Module 5

• Who Gets Access? Authorization and Access Control
• Authentication versus authorization
• Subjects, objects, permissions, and entitlements
• Least privilege and need-to-know
• RBAC and ABAC
• Privileged access; access reviews and recertification
• Separation of duties

Module 6

• Trust Across Systems: Federation and Single Sign-On
• What federation means
• Identity provider and relying party
• Credentials versus assertions
• Single sign-on
• Federated authentication
• Federation Assurance Levels
• Introductory SAML, OAuth, and OpenID Connect
• Benefits and risks of centralized and federated identity

Module 7

• Putting ICAM to Work: From Identity to Access Decision
• A typical access transaction from sign-in to resource access
• Applying IAL, AAL, and FAL
• MFA selection based on risk
• Zero Trust access decisions
• Logging and monitoring identity activity
• Common ICAM implementation mistakes
• Scenario exercises