Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Access Control > Flashcards

Access Control Flashcards

1
Q

CIA

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

Aceess controls protect against:

A

Threats such as unauthorized acess, inappropriate modification of data, and loss of confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

DAD

A

Opposing forces of CIA. Disclosure, Alteration, Destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Confidentiality

A

Seeks to prevent unauthorized read access. Example is PII

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Integrity

A

Seeks to prevent unauthorized modification of information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Two types of Integrity

A

Data Integrity & System Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Data Integrity

A

seeks to protect information against unauthorized modification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

System integrity

A

seeks to protect a system from unauthorized modification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Availability

A

ensures that information is available when needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

AAA

A

Authentication, Authorization, Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Identity

A

a claim of who you are (like a username)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Authentication

A

proving an identity claim (like a password)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Authorization

A

actions you perform on a system once you have identified and authenticated. May include, read, write, execute files/programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Accountability

A

holds users accountable tofr their actions. Typically done by logging and analyzing audit data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Non-Repudiation

A

user cannot deny having performed a transaction. You must have authentication and integrity to have non-repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Least privilege

A

users should be granted the minimum amount of access (authorization) required to do their jobs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Need to know

A

user must need to know that spcific piece of information before accessing it (user must have a business need to access data)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Subject

A

an active entity on a system. Manipulate objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Object

A

Passive data on a system. Do not manipulate other objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Defense in Depth

A

applies multiple safeguards (called controls) to protect an asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which Access control model is the best?

A

none, each model is used for a specific information security purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the primary Access Control Models?

A

Discretionary Access Control (DAC), Mandatory Access Control (MAC), and Non-Discretionary Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is DAC?

A

Discretionary Access Control?gives subjects full control of objects they have been given access to, includeing sharing the objects with other subjects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is MAC?

A

Mandatory Access Control?primarily for Gov’t/Military?system-enforced access control based on subject clearance level and object labels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Two types of non-discretionary access control
Role-based Access Control (RBAC) and Task-based access control
25
What is RBAC?
Role-based Access Control: defines how info is access on a system based on the role of the subject.
26
Three rules of RBAC?
1. Role Assignment 2. Role Authorization 3. Transaction Authorization
27
Task-based access control
based on the tasks each subject must perform (focuses on specific tasks rather than roles)
28
Content- and Context-dependent access controls
not full fledged access control methods in their own right, but are part of a defense in depth supporting role
29
Centralized access control
concentrates access control in one logical point for a system or organization
30
Decentralized access control
IT administration to occur closer to the mission and operations of the organization. Also called distributed access control
31
Identity Lifecycle Rules
\* password policy compliance checking \* notifying users to change passwords before they expire \* ID lifecycle changes such as inactive accounts \* ID new accounts not used for 10 days \* ID suspended accounts \* Id all accounts belonging to expired contract
32
Access aggregation
Individual users gain more access to a system over time as jobs change and permissions aren't removed
33
What is RADIUS
Remote Authentication Dial-In User Service: considered an AAA system
34
What is Diameter
successor to RADIUS; provided an improved AAA framework
35
What is TACACS and TACACS+
Terminal Access Controller Acces Control System: centralized access control system that requires users to send an ID and password for authentication
36
PAP?
Password Authentication Protocol referred to not a strong authentication method. Sends password in clear text
37
CHAP?
challenge handshake authentication protocol: provides protection against playback attacks; depends upon a secret known to authenticator and the peer
38
3 concepts that affect access control?
1. least privilege 2. separation of duties 3. rotation of duties
39
separation of duties
checks and balances
40
rotation of duties
requires different staff members to perform the same duty
41
Describe 3 security labels used by Gov't
Top Secret: Exceptionally Grave Damage Secret: Serious Damage Confidential: Damage
42
Clearance
determinate whether or not a use can be trusted with a specific level of information
43
Rule-Based Access Control
think firewalls. Uses a series of defined rules, restrictions and filters for accessing objects
44
ACL
Access Control List: list of objects and the subjects that may access that object
45
6 Access Control Types
1. Preventative 2. Detective 3. Corrective 4. Recovery 5. Deterrent 6. Compensating
46
3 Access Control Categories
1. Administrative 2. Technical 3. Physical
47
Admiministrative Access Control
also called directive; think paperwork
48
Technical Access Control
implemented using software, hardware, or firmware?think buy/install something
49
Physical Access Control
implemented with physical devices like doors, locks, guards, dogs, etc
50
Preventative Access Control
prevent actions from happening; assigning of privileges on a system
51
Detective Access Control
controls that alert during or after a successful attack; CCTV, bldg alarm system
52
Corrective Access Control
work by correcting a damaged system or process; think antivirus software and HIDS, NIDS, HIPS, NIPS
53
Recovery Access Control
restores functionality of a system and organization
54
Deterrent Access Control
deters users from performing an action; think warning banners and "Beware of Dog" signs
55
Compensating Access Control
security control put in place to compensate for a weakness in other controls
56
3 types of authentication methods
Type 1 - Something you know Type 2 - Something you have Type 3 - Something you are
57
Describe 4 types of passwords
1. Static 2. Passphrases 3. One-Time Passwords 4. Dynamic passwords
58
Strong Authentication
requires users to present more than 1 type of authentication factor
59
Hashing
one-way algorithm used to verify the integrity of data; uses an algorithm and no key
60
Dictionary Attack
uses words from a dictionary and runs words through hashing algorithm, then tries to match hash
61
Brute-force attack
take more time, more effective; calculates the hash of every possible password
62
Rainbow tables
database that contains the precomputed hashed output for more or all possible passwords
63
Hybrid attack
appends, prepends, or changes characters in words from a dictionary attack before hashing
64
Salt
allows 1 password to hash differnent ways by adding a salt before hashing
65
Synchronous Dynamic Token
use time or counters to synchronize a displayed code with code expected by server
66
Asynchronous Dynamic Token
not synchronized with central server; commonly challenge-response tokens
67
Describe FRR, FAR, and CER
as False Reject goes down, False accept goes up. They cross as Crossover Error Rate
68
Which biometric control has potential health issues
retina scan
69
Someplace you are
potential use for GPS to allow/disallow service based on where the activity takes place. Think credit cards
70
Single Sign on advantages
- improved user and developer productivity - simplified admin
71
single sign on disadvantages
-difficult to retrofit - unattended desktops - single point of attack
72
FIdM
Federated Identity Management; applies SSO at a much wider scale from cross-org to Internet
73
Kerberos
thid party authentication service that may be used to support SSO; uses KDC, TGS, TGT, Principal, Realm, Ticket, Credentials, C/S
74
Principal
client (user) or service in Kerberos
75
Realm
logical Kerberos network
76
Ticket
data that authenticates a principal's identity in kerberos
77
Credentials
a ticket and a service key in kerberos
78
KDC
Key distribution center which authenticates principals--pivotal piece of kerberos
79
TGS
Ticket granting service
80
TGT
ticket granting Ticket, good for a site-selected specific lifetime; allows typical uer to authenticate once and access network resources for the lifetime of the ticket
81
C/S
client/server in kerberos
82
Kerberos strengths
provides mutual authentication of client server; mitigates replay attacks via use of timestamps
83
kerberos weaknesses
stores keys of all principals, replay attacks still possible
84
SESAME
Secure European Ssytem for Application in a Multivender Environment; SSO supporting heterogeneous environment; addes to kerberos; uses Privilege Attribute Certificates (PAC)
85
Security Audit Logs
easiest way to verify access control methods are working. Primarily a detective control
86
5 distinct problems of audit logs
1. logs not reviewed 2. logs/trails not stored long enough 3. logs not standardized or viewable 4. log entries/alerts not prioritized 5. logs reviewed only for "bad" stuff
87
Types of attackers
hackers, black/white hats, script kiddies, outsiders, insiders, hacktivist, bots/botnets, phishers/spear phishers
88
Zombie
aka bot (computer system running malware controlled via botnet)
89
vishing
automated voice scripts over a VoIP network
90
penetration testing
white hat hacker trying to see if a black hat hacker can get into the system
91
types of penetration testing
zero-knowledge/black box, full-knowledge/crystal-box, partial-knowledge

CISSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions