Kerberos, biometric CER math, NIST 800-63 assurance, and PAM lifecycle

Biometric accuracy (FRR, FAR, CER) and NIST SP 800-63 assurance

Authentication factors fall into three classic categories: Something You Know (password, PIN - Type 1), Something You Have (FIDO2 security key, smart card - Type 2), and Something You Are / Do (biometrics - Type 3). True Multi-Factor Authentication (MFA) requires combining at least two distinct factor categories (a password plus a PIN is merely two instances of Something You Know, not MFA).

Because biometric readings (fingerprint, iris, retina, palm vein, voice, facial geometry) are probabilistic rather than exact bit matches, administrators tune a sensitivity threshold against two competing error rates. A Type I Error, or False Rejection Rate (FRR), occurs when a legitimate enrolled user is rejected (hurting availability and user productivity). A Type II Error, or False Acceptance Rate (FAR), occurs when an unauthorized impostor is falsely accepted as valid. For high-security vaults, FAR (Type II) is the most dangerous failure and is tuned as close to zero as possible. To compare two competing biometric products objectively, architects look at the Crossover Error Rate (CER, or Equal Error Rate, EER) - the intersection point where FRR == FAR. The lower the CER percentage, the more accurate the biometric device.

NIST SP 800-63 separates digital identity assurance into three independent dimensions rated 1 to 3: Identity Assurance Level (IAL, how rigorously the human’s real-world identity was proofed with government IDs and biometrics at registration), Authenticator Assurance Level (AAL, the strength of the authentication mechanism, where AAL3 mandates a hardware-based, verifier-impersonation-resistant cryptographic key such as FIDO2/WebAuthn or PKI PIV card), and Federation Assurance Level (FAL, the cryptographic protection of assertions sent between an IdP and RP).

How Kerberos works: KDC, AS, TGT, TGS, and ticket attacks

Kerberos (standardized in RFC 4120 and used as the default authentication protocol in Active Directory) uses symmetric cryptography and trusted third-party tickets so plaintext passwords never travel across the network. The central trusted server is the Key Distribution Center (KDC), which houses two logical services: the Authentication Server (AS) and the Ticket Granting Server (TGS).

A Kerberos login follows three steps. First, the client sends a timestamp encrypted with a hash of the user’s password to the Authentication Server (AS); the AS verifies the timestamp and returns a Ticket Granting Ticket (TGT, encrypted with the KDC’s own krbtgt secret key) plus a session key. Second, when the user wants to open a file share or database, the client presents the TGT to the Ticket Granting Server (TGS); the TGS returns a specific Service Ticket (encrypted with the target server’s secret key). Third, the client presents that Service Ticket directly to the target server to establish the session.

Because Kerberos relies on timestamps to block replay attacks, strict NTP clock synchronization stays mandatory across the domain. Defenders watch for three classic Kerberos attacks: Kerberoasting (any domain user requests a TGS Service Ticket for a service account SPN and cracks the service account’s weak password offline), Golden Ticket (an attacker steals the KDC’s krbtgt hash and mints forged TGTs for any user with full Domain Admin rights), and Silver Ticket (an attacker steals a single service account’s hash and forges Service Tickets for that one server without talking to the KDC).

Identity lifecycle (Joiner-Mover-Leaver), SCIM, and Privileged Access Management (PAM)

Identity Governance and Administration (IGA) manages the full Joiner-Mover-Leaver lifecycle. When an employee joins, automated provisioning (often using SCIM - System for Cross-domain Identity Management, a REST/JSON standard for syncing users and groups between an IdP and SaaS apps) grants baseline birthright roles. When an employee moves between departments, the biggest hazard is Privilege Creep (accumulating new permissions without revoking old ones), which is combated through periodic User Access Reviews (access recertification / attestation) signed by business managers.

For administrator accounts, Privileged Access Management (PAM) enforces zero standing privileges through Just-in-Time (JIT) elevation and Just-Enough-Administration (JEA): engineers log in with standard accounts and check out an ephemeral, time-boxed credential from a PAM vault (with automated password rotation and keystroke/session recording) only when an approved change ticket is active.