Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 5: Identity and Access Management 13% > Flashcards

Domain 5: Identity and Access Management 13% Flashcards

1
Q

Access Control

A

who do we give access and what do we give them access to. Spans all layers of our def DID model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

IAAA (ID, Authn, Auth, Acct)

A

Access Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Identification

A

your username, ID #, Employee #, SSN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Authentication

A

Should always be with MFA (multi-fac authen)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Type 1 Authentication

A

Something you know- pwd, pass phrase, PIN etc, also called Knowledge factors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Type 2 Authentication

A

Something you have- ID, Passport, Smart Card, Token, cookie on PC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Type 3 Authentication

A

Something you are- Biometrics: fingerprint, Iris scan, facial geometry etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Type 4 Authentication

A

Somewhere you are- IP/MAC address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Type 5 Authentication

A

Something you do- signature, pattern unlock

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

MFA (multi-fac authen)

A

requires authn from 2 or more categories (Types)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Type 1 Brute Force attacks

A

Uses the entire key space (every possible key), with enough time any plaintext can be decrypted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Type 1 Dictionary attacks

A

based on a pre-arranged listing, often dictionary words.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Type 1 Rainbow tables attacks

A

Pre-made list of plaintext and matching ciphertext.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Type 1 Salt (salting)

A

random data that is used as an additional input to a one-way function that hashes a password or passphrase.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Type 1 Nonce

A

arbitary # that may only be used once.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Type 1 Clipping levels

A

are in place to prevent administrative overhead.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Type 2 Single-use pwd

A

Something you have.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Type 2 Smart Cards

A

They contain a compu circuit using an integrated circuit chip. Some are contact cards others are contactless cards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Type 2 Token HOTP

A

(HMAC-based 1-time pwd) shared secret and incremental counter, generate code when asked, valid till used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Type 2 TOTP

A

(Time-based 1-time pwd) Time based shared secret, often gener every 30/60sec

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Type 3

A

False accept means allowing unauth people to access a resource. Falso reject means denying a ligitamit user access to a resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Type 3 FRR (False rejection rate) Type 1 error

A

authorized users are rejected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Type 3 FAR (False accept rate) Type 2 error

A

Unauthorized user is granted access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Type 3 CER (Crossover Error Rate)

A

Where FRR and FAR meet on the graph. We want this.

25
Q

If it is Confidentiality we are concerned with

A

we would most likey go with Mandatory Access Ctrl

26
Q

If it is Availability we are concerned with

A

Discretionary Access Ctrl

27
Q

If it is Interity we are concerned with

A

Role based Access Ctrl or Attribute Based Access Ctrl

28
Q

DAC (Discretionary Acc Ctrl)

A

access to an object is assigned at the discretion of the object owner. Commonly used by OS’. Uses DACL’s (Discretionary ACL) based on user id.

29
Q

MAC (Mandatory Acc Ctrl)

A

Acc to an obj is determined by labels and clearance, this is often used in the milit or in orgs where confidentiality is very important. Labels: Objects have labels assigned to them Clearance: Subjects have Clearance assigned to them.

30
Q

RBAC (Role Based Acc Ctrl)

A

Policy neutral access cntrl mechanism defined around roles and privileges. The most common used form of acc control.

31
Q

ABAC (Attribute Based Acc Ctrl)

A

Acc to objects is granted based on subjects, objects AND enviro conditions.

32
Q

Context-based acc ctrl

A

acc to an obj is ctrld based on certain contextual parameters, such as location, time, sequence of responses, access history.

33
Q

Content-based acc ctrl

A

acc is provided based on the att or content of an obj, . EG hiding or showing menus in an app depending on user.

34
Q

Accountability (often referred to as auditing)

A

trace an action to a subjects id. Proves who performed given action, it provides non-repudiation. Uses audit trails and logs, to associate a subject with its actions.

35
Q

Hybrid Acc Cntrl Sys

A

Controlled centralized, but the access lists for that location are pushed daily/hourly to a local server, local admins have no access.

36
Q

Identity and access provisioning

A

We can have multiple identities per entity and each identitiy can have multiple attributes.

37
Q

FIDM (Federated Identity Management)

A

having a common set of policies, practices and protocols in place to manage the id and trust into IT users and devices across organizations.

38
Q

FIDM technologies

A

SAML, OAuth, OpenID, Security Tokens, Microsoft Azure Cloud Services, Windows ID Foundation

39
Q

SSO (single sign-on) is a subset of FIDM

A

it only uses authentication and tech interoperability. Users use single sign-on for multiple systems. Often deployed in orgs where users have access to 10+ systems, and they think its too burdensome to remember all those passwords.

40
Q

SAML (Security Assertion Markup Language)

A

An XML-based, open stndard data format for exchanging authn and aurthorization data between parties. **The single most important req that SAML addresses is web browser SSO.

41
Q

Super sign-on

A

One login can allow you to access many sys and sites. If an account is compromised an attacker can often access multiple other sites or sys.

42
Q

IDaaS (Identity as a Service)

A

Identity and access management that is built, hosted and managed by a third-party service provider. Native cloud-based IDaaS solu can provide SSO func through the Cloud, Fed ID Management for Access Governance, Pwd Management. Hybrid IAM sol from vendors like MS and Amazon provide cld-based directories that link with on-premises IAM systems.

43
Q

Authentication protocols

A

it is the most important layer of protection needed for secure communication btw networks.

44
Q

Kerberos

A

works on basis of tickets to allow nodes comm over a non-secure network to prove their Id to each other. Named after 3 headed guard dog of Hades. Based on client-svr mdl and provides mutual authn. Messages are protected agnst eavesdropping and replay attacks. Builds on symmetric keys and requires a trusted third party, can optionally use PKI. Uses UDP 88 by default, used in AD from Win 100 and onwards, many Unix OS’. Pros: Easy for end users, centrailized ctrl and easy to admin. Cons: Single pof, access to everything with single pwd.

45
Q

SESAME (Secure Euro Sys for App in a Multivendor Enviroment)

A

often called the successor to KERBEROS. It uses PKI encryp(asymmetric). Not widely used, because Kerberos is already included in most OS’.

46
Q

RADIUS (Remote Authn Dial-in User Service)

A

provides centralized Authn, Author, and Accounting management for users who cxn and use a ntwk srvc. Widely used by ISP’s and large orgs to manage acc to IP ntwks, AP’s, VPN’s, servers, 802.1x. Runs in App layer, can use TCP or UDP as transport. Network access servers, the gateways to control access to a network, usually contain a RADIUS client component that communicates with the RADIUS server. Use UDP ports 1812 for authn and 1813 for acct can use TCP as the transport layer with TLS for security.

47
Q

Diameter

A

was intended to replace RADIUS, not never really happened because it is not backwards compt with RADIUS. Switches and AP’s implement RADIUS, but not Diameter. Uses SCTP/TCP.

48
Q

TACACS

A

Centralized acc cntrl sys requiring users to send an ID and reusable (vulnerable pwd for authn. Uses TCP/UDP port 49. It has been replaced by TACACS+ and RADIUS

49
Q

TACACS+

A

Provides better pwd protection by using 2 factor authn. Not backwards compat w/TACACS. Uses TCp 49 for authn with srvr. Simliar to RADIUS, but RADIUS only encrypts the pwd. TACACS+ encrypts the entire data package.

50
Q

PAP (Password Authn Protocol)

A

No longer used because not secure. Credentials are sent over the network in plain text.

51
Q

CHAP (Challenge-Handshake Authn Protocol)

A

Provides protect against reply attacks by the peer through the use of an incrementally changing identifier and of a variable challenge-value. Requires the client and server know the plaintext of a shared secret, but it is never sent over the network. Used by PPP srvrs to validate the remote clients. Periodically verifies the id of the client by using a 3-way handshake. Vul because it stores plaintext passwords of each client, if an attacker gains access to the srvr they can steall all the pwds on it.

52
Q

AD (Active Directory)

A

broad range of directory-based identity-related services. Uses LDAP v2/3, Microsoft’s v of Kerberos, and DNS. Uses groups to control access by users to data objects, often used as a RBAC where roles are assigned to groups.

53
Q

AD can use Trust domains

A

which allow users in one domain to access resources in another.

54
Q

1-way trust

A

One domain allows access to users on another domain, but the other domain does not allow access to users on the first domain.

55
Q

2-way trust

A

2 domains allow access to users on both domains.

56
Q

Trusted domain

A

the domain that is trusted/ whose users have access to the trusting domain

57
Q

Transitive trust

A

a trust that can extend beyon two domains to to other trusted domains in the forest.

58
Q

Intransitivie (non-transitive) trust

A

a 1-way trust that does not extend beyond 2 domains.

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions