2. Access Control Flashcards
1
Q
access control process
A
identification
authentication
authorisation
2
Q
what is authentication
A
prove you are who you claim to be by:
- knowledge (what you know)
- Token (what you have)
- biometrics (what you are)
3
Q
knowledge based authentication
A
passwords
passphrases
4
Q
password bad practices
A
- reused
- easily guessed
- shared
- written down
- password manager: single point of failure
5
Q
password entropy
A
measure of uncertainty
- password of K bits has pow(2, K) possibilities
- password of length L from B chars has pow(B, L) possibilities
- entropy H = log2(pow(B,L))
6
Q
attacking passwords
A
- brute force
- try all combinations
- use account lock out to prevent brute force
- need to exfiltrate data before brute force - reverse brute force
- try one password on multiple accounts - dictionary
- contains commonly used passwords
- stored in plain text - rainbow tables
- contains commonly used passwords
- stored in hashes - social engineering
7
Q
password hardening
A
- formulate good passwords
- store in password managers to help remember
- use passphrases
- secure storing of passwords
- encrypt password (minimum)
- hashed password (ok..)
- hashed password + salt (best) - enforce security policies
- 2FA
- educate users on best practices and increase awareness
- maintain correct access rights
8
Q
what are tokens
A
physical devices to aid authentication
- e tokens
- RFID tags
- used in logistics, prison, but weak to side channel attack - smart cards
- tamper proof
9
Q
types of biometrics
A
physical
behavioural
10
Q
requirements for biometrics
A
- university
- everyone must have that characteristic trait - distinctiveness
- characteristics should be sufficiently different - permanence
- characteristics should be sufficiently invariant - collectability
- characteristics can be measured quantitatively
11
Q
acceptability of biometrics
A
authentication needs to be accepted by end users
- convenience
- duration of authentication
- invasion of privacy
12
Q
accuracy of biometrics
A
- false/ true accept rate
- retina scanning
- iris scanning
- facial recognition
- fingerprint
13
Q
behavioural
A
how you type/walk
can change over time
people may have similar behaviours
14
Q
voice recognition
A
is both behavioural and physical
15
Q
biometrics advantages
A
- unique data, difficult to replicate
- fast and convenient
- no issue of missing tokens, forget passwords - scalable
- just add data to DB
