Kerberos is a network authentication protocol that uses time-limited tickets to let systems prove their identity over an untrusted network without sending passwords across it. Developed at MIT and used as the default authentication mechanism in Windows Active Directory, it underpins single sign-on across enterprise environments.
After a user authenticates once, the Key Distribution Center issues a Ticket Granting Ticket (TGT). To reach a specific service, the user presents that TGT and receives a service ticket the target validates on its own, so the KDC is not consulted for every request. This ticket design is efficient but attractive to attackers, who go after it through Kerberoasting, Pass-the-Ticket, and Golden Ticket techniques. Because Kerberos relies on synchronized clocks, significant time skew between hosts will break authentication outright, a detail worth remembering when tickets suddenly stop working.
How is Kerberos tested on the CISSP?
Kerberos is core material in Domain 5: Identity and Access Management. Candidates should be able to walk through the authentication flow, describe the KDC role, recognize common attacks, and explain how the protocol enables single sign-on. Delegation, cross-realm trust, and the risks of over-privileged service accounts are fair game in tougher questions.