Identity and Remote Access Defense Design: SSO, MFA, Machine Authentication, Remote Access, FedRAMP and Critical Infrastructure

Assignment: Defenses against threats to identity and remote access

For this lesson’s assignment, you will recommend a design for defenses against threats to identity and remote access. You will be expected to produce a technical diagram as part of the submission using Lucidchart. As part of this assignment, you will address the risks and how your recommendation will reduce those risks. Additionally, you will answer the questions of how the technology you chose in Lesson 4 will help prevent future potential attacks.

• How will your solution allow for and defend against threats to Single Sign-On? How does this change for FedRAMP?
• How will your solution allow for and defend against threats to Multi-Factor Authentication? How does this change for FedRAMP?
• How will your solution allow for and defend against threats to Machine Authentication? How does this change for FedRAMP?
• How will your solution allow for and defend against threats to Remote Access Authentication? How does this change for FedRAMP?
• How will your solution meet the requirements for critical infrastructure?

Original example for study purposes.

Introduction and Risk Overview

Identity has become the primary security perimeter. Attackers increasingly bypass firewalls by stealing credentials, intercepting session tokens, abusing service accounts and exploiting virtual private network (VPN) appliances. Key risks include credential phishing and password spraying, MFA fatigue (push bombing) and adversary-in-the-middle phishing kits that steal session cookies, token theft and forged federation assertions, long-lived secrets in code and misconfigured service accounts, and compromised vendor remote access. The recommended design (Figure 1) applies Zero Trust principles: never trust by default, verify every request using identity and device context, grant least privilege and monitor continuously (Rose et al., 2020). It centralizes authentication in a FedRAMP-authorized identity provider, requires phishing-resistant MFA, manages machine identities with short-lived credentials and replaces broad VPN access with ZTNA and privileged access management (PAM).

Single Sign-On (SSO)

How the solution allows SSO: all cloud and on-premises applications federate to one IdP using SAML 2.0 or OpenID Connect, so users sign in once with strong authentication and receive short-lived, signed tokens for each application. Threats and defenses: because SSO creates a single point of compromise, the design protects it with phishing-resistant MFA at sign-in, conditional access that re-evaluates device health and risk during the session, short token lifetimes and continuous access evaluation that revokes sessions when risk changes. Signing keys are protected in hardware security modules (HSMs) and rotated, federation trust settings are monitored for unauthorized changes (a tactic used in “Golden SAML” attacks) and anomalous logins are sent to the security information and event management (SIEM) system for detection. FedRAMP changes: the IdP itself must be FedRAMP authorized at the appropriate impact level (Moderate or High) and use FIPS 140-validated cryptography. Identification and authentication controls in the NIST SP 800-53 Rev. 5 baseline used by FedRAMP (the IA family) must be documented in the System Security Plan, and federal users must be able to authenticate with PIV credentials. Session and audit settings must meet baseline requirements, and changes are subject to continuous monitoring and significant change review.

Multi-Factor Authentication (MFA)

How the solution allows MFA: users authenticate with FIDO2/WebAuthn security keys, platform passkeys or PIV/CAC smart cards. Threats and defenses: SMS codes and push notifications can be intercepted, SIM-swapped or approved by fatigued users. Phishing-resistant authenticators bind authentication to the legitimate site’s origin, defeating credential-phishing and adversary-in-the-middle attacks. Fallback methods use number matching and are restricted, privileged users must use hardware keys, and MFA registration and recovery require identity proofing to prevent attackers from enrolling their own devices. FedRAMP changes: federal requirements are stricter. OMB Memorandum M-22-09 directs agencies to use phishing-resistant MFA, and FedRAMP systems must support MFA for privileged and nonprivileged accounts consistent with NIST SP 800-63B authenticator assurance levels (AAL2 or AAL3 for high-impact access) and accept PIV credentials (Office of Management and Budget [OMB], 2022).

Machine Authentication

How the solution allows machine authentication: workloads, APIs, servers and IoT devices authenticate with certificates from an internal public key infrastructure (PKI), mutual TLS and OAuth 2.0 client credentials through an API gateway, and cloud workloads use workload identity federation instead of static keys. Threats and defenses: hard-coded passwords, leaked API keys and over-privileged service accounts are common breach paths. The design stores secrets in a vault with automatic rotation, issues short-lived certificates, scans code repositories for exposed secrets, inventories every machine identity and applies least-privilege scopes. Managed devices also present device certificates so conditional access can confirm that the endpoint is corporate and healthy. FedRAMP changes: device and service identification controls (such as IA-3 and IA-9) must be implemented and documented, cryptographic modules must be FIPS validated, keys must be managed under documented key management procedures and machine credentials must be included in the system inventory and continuous monitoring.

Remote Access Authentication

How the solution allows remote access: users reach applications through a ZTNA broker that grants per-application, per-session access only after verifying identity, MFA and device posture, rather than placing them on the internal network through a traditional VPN. Administrators and vendors connect through a PAM bastion (intermediate system) that enforces MFA, just-in-time privilege and session recording. Threats and defenses: VPN appliance vulnerabilities, stolen VPN credentials and vendor accounts have been used in major breaches. ZTNA reduces the attack surface by hiding applications from the internet and limiting lateral movement, while PAM ensures privileged sessions are temporary, approved and auditable. FedRAMP changes: remote access must meet the AC-17 family requirements, including encrypted sessions, managed access control points, monitoring and authorization of remote access; privileged remote commands must be justified and logged; and any remote access tools must themselves be FedRAMP authorized or within the authorization boundary.

Meeting Critical Infrastructure Requirements

For organizations in critical infrastructure sectors, the design aligns with the Cybersecurity and Infrastructure Security Agency’s (CISA) Cross-Sector Cybersecurity Performance Goals, which prioritize phishing-resistant MFA, revoking credentials of departing employees, separating user and privileged accounts, network segmentation and log collection (CISA, 2023). Operational technology (OT) control systems sit in a segmented zone reachable only through the intermediate system, consistent with sector rules such as NERC CIP-005 for electric utilities, which requires interactive remote access through an intermediate system with encryption and MFA. The NIST Cybersecurity Framework 2.0 functions (Govern, Identify, Protect, Detect, Respond and Recover) guide the overall program (National Institute of Standards and Technology [NIST], 2024). Centralized logging supports rapid incident detection and the incident-reporting obligations critical infrastructure entities face.

How the Lesson 4 Technology Prevents Future Attacks

The Zero Trust IdP and ZTNA technology prevents future attacks by removing implicit trust. Stolen passwords are useless without phishing-resistant authenticators, compromised devices fail posture checks, applications are invisible to attackers scanning the internet and least-privilege, time-limited access limits the damage of any compromise. Continuous monitoring with user and entity behavior analytics detects anomalies, such as impossible travel or unusual privilege use, so the security team can respond before attackers achieve their goals.

References

Cybersecurity and Infrastructure Security Agency. (2023). Cross-sector cybersecurity performance goals. https://www.cisa.gov/cross-sector-cybersecurity-performance-goals

National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). https://doi.org/10.6028/NIST.CSWP.29

Office of Management and Budget. (2022). Moving the U.S. government toward zero trust cybersecurity principles (Memorandum M-22-09). Executive Office of the President.

Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST Special Publication 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207