Identity and Access Management Fundamentals bibliography

Standards-body + government · 1

1. Cybersecurity and Infrastructure Security Agency (2022). Implementing Phishing-Resistant MFA. CISA. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf

Other primary sources · 16

1. FIDO Alliance (2024). Client to Authenticator Protocol (CTAP) 2.2. FIDO Alliance. https://fidoalliance.org/specs/fido-v2.2-rd-20230321/fido-client-to-authenticator-protocol-v2.2-rd-20230321.html
2. OASIS Security Services Technical Committee (2005). Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0. OASIS Standard saml-core-2.0-os. https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
3. OASIS Security Services Technical Committee (2005). Bindings for the OASIS Security Assertion Markup Language (SAML) V2.0. OASIS Standard saml-bindings-2.0-os. https://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf
4. World Wide Web Consortium (2021). Web Authentication: An API for accessing Public Key Credentials Level 2 (W3C Recommendation). W3C. https://www.w3.org/TR/webauthn-2/
5. Microsoft Corporation (2024). Microsoft Entra Privileged Identity Management Documentation. Microsoft Learn. https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure
6. Microsoft Corporation (2024). Microsoft Certified: Identity and Access Administrator Associate (SC-300). Microsoft Learn. https://learn.microsoft.com/en-us/certifications/identity-and-access-administrator/
7. Grassi, P. A., Garcia, M. E., & Fenton, J. L. (2017). Digital Identity Guidelines (NIST SP 800-63-3). National Institute of Standards and Technology. doi:10.6028/NIST.SP.800-63-3
8. Grassi, P. A., Newton, E. M., Perlner, R. A., Regenscheid, A. R., Burr, W. E., Richer, J. P., Lefkovitz, N. B., Danker, J. M., Choong, Y. Y., Greene, K. K., & Theofanos, M. F. (2017). Digital Identity Guidelines: Authentication and Lifecycle Management (NIST SP 800-63B). National Institute of Standards and Technology. doi:10.6028/NIST.SP.800-63b
9. Grassi, P. A., et al. (2024). Digital Identity Guidelines, Public Draft Revision 4 (NIST SP 800-63-4). National Institute of Standards and Technology. https://csrc.nist.gov/pubs/sp/800/63/4/2pd
10. Hardt, D. (2012). The OAuth 2.0 Authorization Framework (RFC 6749). Internet Engineering Task Force. https://datatracker.ietf.org/doc/html/rfc6749
11. Hu, V. C., Ferraiolo, D., Kuhn, R., Schnitzer, A., Sandlin, K., Miller, R., & Scarfone, K. (2014). Guide to Attribute Based Access Control (ABAC) Definition and Considerations (NIST SP 800-162). National Institute of Standards and Technology. doi:10.6028/NIST.SP.800-162
12. ISC2 (2024). Cybersecurity Workforce Study 2024. International Information System Security Certification Consortium. https://www.isc2.org/research
13. Lodderstedt, T., Bradley, J., Labunets, A., & Fett, D. (2024). Best Current Practice for OAuth 2.0 Security (RFC 9700). Internet Engineering Task Force. https://datatracker.ietf.org/doc/html/rfc9700
14. Sakimura, N., Bradley, J., Jones, M. B., de Medeiros, B., & Mortimore, C. (2014). OpenID Connect Core 1.0. OpenID Foundation. https://openid.net/specs/openid-connect-core-1_0.html
15. Sakimura, N., Bradley, J., Agarwal, N. (2015). Proof Key for Code Exchange by OAuth Public Clients (RFC 7636). Internet Engineering Task Force. https://datatracker.ietf.org/doc/html/rfc7636
16. U.S. Bureau of Labor Statistics (2024). Occupational Employment and Wage Statistics, May 2024: 15-1212 Information Security Analysts. U.S. Department of Labor. https://www.bls.gov/oes/current/oes151212.htm