Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Access Control > Flashcards

Access Control Flashcards

(94 cards)

Start Studying
1
Q

Access Control Systems include

A

File Permissions, Program Permissions and Data Rights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

File Permissions allows

A

Create, Read, Edit or Delete on a File Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Program Permissions allows

A

execution of a program on a server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Data Rights allows

A

right to retrieve or update information in a database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A “SUBJECT” is

A

an ACTIVE entity i.e., an individual or process that accesses an OBJECT.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

An “OBJECT” is

A

a PASSIVE entity i.e., system or process that a SUBJECT ACTS UPON or accesses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

PREVENTIVE controls are for

A

reducing risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

DETECTIVE controls are for

A

identifying violations and incidents.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

CORRECTIVE controls are for

A

remedying violations and incidents and improving existing preventive and detective controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

DETERRENT controls are for

A

discouraging violations and dissuading malicious activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

RECOVERY controls are for

A

restoring systems and information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

COMPENSATING controls are for

A

providing alternative ways of achieving a task.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Preventive controls together with and overall security program are compensated by

A

DETECTIVE, CORRECTIVE, DETERRENT, RECOVERY and COMPENSATING controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

ACCESS controls can be

A

Administrative, Technical, and Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ADMINISTRATIVE controls include

A

policies and procedures that are implemented as part of an overall information security strategy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Types of ADMINISTRATIVE controls may include

A

policies, standards, guidelines and procedures. Security awareness training. Asset clarification and control. Employment policies. Account administration. Account, log and journal monitoring. Review of audit trails.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

TECHNICAL controls are

A

technical ( or logical ) controls that leverage HW or SW to implement access control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

PREVENTIVE TECHNICAL controls include

A

encryption, access control mechanisms, access control lists ( ACLs), Remote Access authentication protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Common technical ENCRYPTION controls are

A

DES ( Data Encryption Standard ) AES ( Advanced Encryption Standard ) and Merkle-Hellman Knapsack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Access Control Mechanisms are

A

Biometrics, Smart Cards, and Tokens.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Access Control Lists ( ACLs ) are

A

permission defining what a SUBECT can or cannot do to an object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Remote Access Authentication Protocols are

A

PAP ( Password Authentication Protocol ) CHAP ( Challenge HandShake Authentication Protocol ) RADIUS ( Remote Authentication Dial In User Service ) and LDAP ( Lightweight Directory Access Protocol )

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

DETECTIVE TECHNICAL controls include

A

Violation reports, Audit Trails, Network Monitoring and Intrusion Detection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

PHYSICAL controls ensure

A

safety and security of the physical environment they are primarily PREVENTIVE AND DETECTIVE.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
PHYSICAL PREVENTIVE controls include
perimeter protections like; fences, locked entry, restricted area and guards / dogs.
26
PHYSICAL DETECTIVE controls include
Motion detection and video cameras
27
ACCESS CONTOL SYSTEMS provide what three essential services?
Authentication, Authorization, and Accountability.
28
AUTHENTICATION is
( who can log in ) a two step process of Identification and Authentication or ( I&A).
29
IDENTIFICATION is the means by which
a user ( SUBJECT ) presents a specific ID ( like a USERNAME ) to a system ( OBJECT )
30
AUTHENTICATION is the process of verifying
an identity... IDENTIFICATION ( I of I&A) . A USERNAME ( identity) is verified with a PASSWORD ( authentication ).
31
What determines a SUBECT can LOG in
AUTHENTICATION
32
AUTHORIZATION or "establishment" defines
rights and permissions granted to a user account or process. ( what can be done with a system or resource )
33
What determines a what a SUBECT can do with assigned rights and permissions.
AUTHORIZATION
34
ACCOUNTABILITY is the capability to associate users and processes with
ACTIONS ( what they did ) AUDIT TRAILS AND SYSTEM LOGS.
35
"This" determines what a SUBJECT did
ACCOUNTABLITY
36
The ability to irrefutably associate a user with an action that can't be denied is
NON-REPUDATION
37
What are the two categories of ACCESS CONTROL
SYSTEM ACCESS / DATA ACCESS controls
38
SYSTEM ACCESS controls provide
the first line of defense for data contained in a system. This is renowned as AUTHENTICATION but include AUTHORIZATION and ACCOUNTABILITY.
39
AUTHENTICATION is based on 3 FACTORS
something YOU KNOW ( PASSWORD and PINs ), YOU HAVE ( TOKEN or SMART CARD ) YOU ARE ( FINGERPRINT, VOICE, a physical body part )
40
TWO FACTOR authentication requires
two of the three.
41
STRONG authentication requires
at least TWO factors.
42
Using THREE FACTORS is
3 FACTOR authentication.
43
I & A techniques include
passwords/ phrases, PINS, BIOMETRICs, and OTP, Tokens, and SSO.
44
Common or shared accounts as root, admin, or system are examples of accounts that have
no accountability and should not be permitted.
45
The ACT of claiming a specific identity is
IDENTIFICATION
46
The ACT of verifying a specific identity is
AUTHENTICATION
47
The most common and weakest type of AUTHENTICATION is
the password.
48
More difficult to hack the PASSPHRASE uses
a sequence of characters or words that are usually easier to remember.
49
The downside of PASSPHRASE can be
inconvenient to implement ( too long ), system limitations for more than 8 characters or spaces. In the end a passphrase can be considered a password.
50
General challenges with PASSWORDS and PASSPHRASES are
insecure, easily broken, inconvenient, refutable.
51
Passwords or Passphrases are generally insecure because
human nature to select easy password. Transmission and storage in clear text.
52
Passwords or Passphrases are easily broken by
BRUTE FORCE attacks, such as John the Ripper and L0phtCrack
53
Passwords should demonstrate the following security best practices
LENGTH of six to eight characters. COMPLEXITY combination of upper lower case, special characters, AGING, which requires changes at regular intervals. HISTORY, allowing historical memory of up to 5 previous passwords, and LIMITED ATTEMPTS, defined number of unsuccessful log on attempts before lock out. LIMITED TIME PERIODS restrictions to when a user can log in, time of day. SYSTEM MESSAGES; LOGIN BANNER defining terms of use, and LAST USERNAME ( which should be disabled ) LAST SUCCESSFUL LOGIN unveils unlikely log in attempts.
54
PINS are relatively weak authentication because
there are only 10,000 possible combinations to a four digit PIN.
55
BIOMETRICs are based on THIRD FACTOR AUTHENTICATION which is
something YOU ARE. It is not considered STRONG authentication as it only uses one of three authentication requirements.
56
BIOMETRICS access controls can be
PHYSICAL, presenting a biometric characteristic to be verified against a database. LOGICAL entry of a username or password plus a biometric characteristic.
57
EFFECTIVE BIOMETRIC systems demonstrate
ACCURACY, SPEED and THROUGHPUT, DATA STORAGE REQUIREMENTS, RELIABILITY, ACCEPTABILITY
58
ACCURACY in BIOMETRICS is defined by
FALSE REJECT RATES ( FRR) TYPE 1 ERROR and FALSE ACCEPTANCE RATE TYPE 2 ERROR
59
( ! ) FALSE REJECT RATE ( FRR ) TYPE 1 ERROR
is the percentage of authorized users to whom the system incorrectly denies access.
60
( ! ) FALSE ACCEPT RATE ( FAR ) TYPE 2 ERROR
is the percentage of unauthorized users to whom the systems incorrectly grants access.
61
( ! ) CROSSOVER ERROR RATE
is the point at which the FRR equals the FAR stated as a percentage. It is considered the most important measure of BIOMETRIC accuracy.
62
( ! ) The most common difficulty with BIOMETRIC systems is
gaining user acceptance.
63
COMMON TYPES of PHYSIOLOGICAL access control systems include
Fingerprint recognition and scan, Hand geometry, Retina pattern, Iris pattern.
64
COMMON TYPES of BEHAVIORAL access control systems include
Voice, Signature dynamics, Keystroke or Typing dynamics.
65
ONE TIME PASSWORD is valid for
one log-on session only, after the session the PW is no longer valid. They provide maximum security for access control. ( TOKENS and S/KEY are types of OTP )
66
TOKENS are
two factor authentication ( something you have and something you know ) key fobs, dongles, smart cards, soft tokens, that store static passwords ( digital certificate ) or generate dynamic passwords.
67
The THREE general types of TOKENS are
STATIC PASSWORD ( digital certificate ) SYNCHRONOUS DYNAMIC PW ( timed event ) ASYNCHRONOUS DYNAMIC PW.
68
SINGLE SIGN ON addresses
multiple systems and multiple logins. Address human factor of poor password implementation / selection and productivity impact on user and IT maintenance team.
69
SSO challenges are
unrestricted access to multiple systems once logged in , and complexity to deploy the services.
70
SSO leverages these common third party ticket based services.
KERBEROS, SESAME, KRYPTOKNIGHT
71
In Kerberos two types of keys are
a SESSION KEY ( dynamic ) and a SECRET KEY
72
A SESSION KEY ( dynamic ) is
generated when needed and shared between two principals then destroyed as no longer need.
73
A SECRET KEY is
a static key that is used to encrypt a session key.
74
SEASAME =
SECURE EUROPEAN SYSTEM and APPLICATIONS in a Multi-vendor Environment.
75
SEASAME is a
ticket based system developed by the EUROPEAN COMPUTER MANUFACTURERS ASSOCIATION. ECMA
76
KRYPTOKNIGHT
ticket and key distribution system developed by IBM and provides two party authentication, key distribution and data integrity services.
77
( ! ) Three examples of TICKET BASED SSO services for AUTHENTICATION ARE
KERBEROS, SESAME, KRYPTOKNIGHT
78
Access Control Methodologies are generally classified as
CENTRALIZED or DECENTRALIZED
79
( ! ) CENTRALIZED ACCESS CONTROL examples include
LDAP ( Lightweight Directory Access Protocol ), RAS ( Remote Access Service ), RADIUS ( Remote Authentication Dial-in User Service ), DIAMETER, TACACS ( Terminal Access Controller Access Control System ),
80
REMOTE ACCESS SERVICE leverages Point to Point Protocol ( PPP ) to encapsulate IP packets and uses the following three authentication protocols
PAP ( Password Authentication Protocol ), CHAP ( CHALLENGE HANDSHAKE AUTHENTICATION PROTOCOL ), EAP ( Extensible Authentication Protocol )
81
DECENTRALIZED ACCESS CONTROL includes
multiple domains and trust, databases controlled by a DataBase Management System.
82
( ! ) A Database view is
a type of constrained user interface. Restricting access to specific functions by not allow requests of those functions.
83
Data Access Controls include
DISCRETIONARY ACCESS CONTOL, and MANDATORY ACCESS CONTOL
84
( ! ) Who determines access policy in DISCRETIONARY ACCESS CONTROL
OWNER
85
TWO CONCEPTS of DISCRETIONARY Access Control are
File and Data Ownership / Access Rights and Permissions
86
TWO CONCEPTS of MANDATORY Access Control are
Sensitivity Labels / Data Import Export
87
( ! ) What determines access policy in MANDATORY ACCESS CONTROL
SYSTEM
88
ACCESS CONTROL MODELS are
BELL - LA PADULA, BIBA, CLARK-WILSON, NonINTERFERRENCE MODEL, ACCESS MATRIX MODEL, INFORMATION FLOW MODEL.
89
BELL - LA PADULA defines two properties
Simple Security property ( ss property ) and *-property ( start property )
90
( ! ) BELL - LA PADULA addresses
CONFIDENTIALITY
91
( ! ) BIBA and CLARK WILSON addresses
INTEGRITY
92
ACCESS CONTOL ATTACKS are
Brute-Force or Dictionary Attack, Buffer or Stack overflow, Man in the Middle, Packet Sniffing, Session Hijacking, Social Engineering.
93
Tactics to deploy against Access Control attacks are
Threat Modeling, Asset Valuation, Vulnerability Analysis, and Access Aggregation.
94
Access Control Evaluation and Testing include
Port Scanning, Application Scanning, Blackbox testing, Whitebox testing, Greybox teststing, Host Scanning, Operating system detection.

CISSP (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions