Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Access Control > Flashcards

Access Control Flashcards

1
Q

Provide an example of a “Subject” and an example of an “Object”

A

Subject - Anything operating on something else

Object - The thing being operated on

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Definition of Access Control

A

Any hardware, software, administration, or process that performs the following tasks:

  • Identifies users or subjects attempting to access resources
  • Determines if access is authorized
  • Grants or restricts access
  • Monitors and records access activities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Can a subject be an object and then change repeatedly?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Explain Users vs Owners

A

User accesses and object and an owner determines which users can access the object.

There can be only one owner but multiple users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the CIA Triad?

A

C - Confidentiality… Can we keep the wrong people out?
I - Integrity… ensure only authorized changes occur
A - Availability… Is it available when I need it?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the difference between rights and permissions?

A

Interchangeable… but a permission seems to be a lower level authorization and rights tends to be higher level (system wide).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are privileges?

A

The combination of rights and permissions (whole assembly).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the 7 types of access control?

A

Preventive - Gates, fences, passwords, biometrics
Detective - log analysis, CCTV (after the fact)
Corrective - Modification after something happened
Deterrent - Policies, signs, etc
Recovery - Repairs/ fixes made to fix
Directive - Signs, manuals, supervisors
Compensation - Compensating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are Administrative Controls

A

Policies, procedures, hiring practices, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are logical/ technical controls

A

Hardware or software controls (usernames, passwords or biometrics)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are Physical Controls

A

This that can be physically interacted with (door locks, mantraps, etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a defense in depth strategy?

A

The use of multiple layers (typically three)

  1. Administrative
  2. Logical/ technical
  3. Physical
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the elements of access control?

A

Authentication - Proof of a claimed identify
Authorization - Subject is granted access to objects on a proven identity
Accountability - Auditing to track subjects use of objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the three types of Authentication?

A
  1. Something you know (password)
  2. Something you have (token) (somewhere too)
  3. Something you are (finger prints)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Effective accountability relies on which two of the three: Authentication, authorization, identification

A

Authorization - We just need to know who they are (reliably) and that they got in appropriately. Logging should cover whether or not it was properly authenticated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Name several “good” authentication techniques

A

Passwords, god password selection, password aging, password complexity, password history

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Name some examples of cognitive passwords

A

Date of birth, mothers maiden name, first pet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Are cognitive passwords effective?

A

Not in the age of social engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Explain a synchronous dynamic password token

A

Device that generates a token at the same time a synchronized server generates the same token. usually requires a time server to keep the two in sync.

20
Q

Explain an asynchronous dynamic password token

A

a token is generated after a password is entered into the device.

21
Q

Explain a static token

A

Could be a USB key that is inserted into a computer.

22
Q

Define some biometric controls based on order of accuracy

A 
Retina - Seen as bad because it can display health issues
Iris - Does not change over time but can be spoofed with high quality image
Fingerprint - Can be spoofed
Face
Finger/ Palm
Heart/ Pulse
Voice Pattern - issues with consistency
Keystrokes - Not accurate
23
Q

What is FRR?

A

False Rejection Rate(false negative)

24
Q

What is FAR?

A

False Acceptance rate(False positive)`

25
Q

What is worse (FAR or FRR)

A

FAR - False Authorization

26
Q

What is CER

A

Crossover error rate - rate at which the FAR & FRR are balanced.

A higher CER means that the solution is less accurate compared to a system with a lower CER.

27
Q

Explain CER sensitivity

A

Strategy to dial in the accuracy of biometrics. We may de-tune the system to provide more false rejections. This means we do not mind annoying people.

28
Q

What is multi factor authentication?

A

The use of multiple Authentication Types (type1, type 2, type 3).

29
Q

What are the principles of security operations?

A

Need to Know
Least Privilege
Separation of duties

30
Q

Explain DAC.

A

Discretionary access controls… Method to allow Object owner the ability to control and define Subject access to the Object.

31
Q

Provide an example of Non-discretionary access

A

Systems like SAP & Oracle user ND. This is where roles are used that can allow central system-wide changes.

32
Q

Explain rule based access

A

Rule based systems are appropriate for environments with constant changes to data permissions.

33
Q

Where is lattice based security appropriate?

A

In an environment where the Object is refined over a period of time and Subject access can change as the Object is refined.

34
Q

Explain Mandatory Access Controls and provide an example.

A

It employs the use of attributes to define the Object.

35
Q

Name the core elements of Kerberos

A

Key Distribution Center (KDC)
Kerberos Authentication Server (KAS)
Ticket Granting Ticket (TGT)
Ticket

36
Q

Where is federated SSO used?

A

When trying to link multiple non related environments/ systems/ companies

37
Q

What are the AAA Protocols

A

Authentication
Authorization
Accounting

38
Q

When is Radius used?

A

In connecting external locations via telecom links

39
Q

When is Diameter more appropriate than Radius

A

In mobile environments

40
Q

Name multiple Authorization Mechanisms

A

Implicit Deny
Access Control Matrix
Constrained interface

41
Q

What is the Identity & Access Lifecycle

A
  1. Provisioning
  2. Regular Review
  3. De-provisioning
42
Q

What is the difference between authentication, authorization, and identification?

A

Subjects claim an identity
Subjects prove their identity via authentication
Subjects interact with Objects via authentication

43
Q

What is SPML

A

Service Provisioning Markup Language - XML based method of federated SSO.

44
Q

What technology uses software to manage access to resources?

A

software/ technical.

45
Q

What is NOT needed for system accountability?

A

Authentication.

46
Q

What is an Access Control List based on?

A

Subjects

47
Q 
What is not needed for SSO?
A. Kerberos
B. Federated Identity
C. TACAS
D. SPML
A

TACAS

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions