Access Control Flashcards

Question

Federated Identity

Answer 1

portable identity that can be used across organizations Each organization that joins federation agrees to enforce common policies and standards Cross-Certification Model each organization certifies every other one is trusted. Each organization must verify and certify other orgs meet or exceed standards Trusted third party or bridge Model Each organization subscribes to standards of a third party, the third party manages verification, certification, due diligence for all organizations

Answer 2

portable identity that can be used across organizations Each organization that joins federation agrees to enforce common policies and standards Cross-Certification Model each organization certifies every other one is trusted. Each organization must verify and certify other orgs meet or exceed standards Trusted third party or bridge Model Each organization subscribes to standards of a third party, the third party manages verification, certification, due diligence for all organizations

Answer 3

Organization's ability hold users responsible for their actions Usually involves Auditing, Reporting Vulnerability Assessments Penetration Testing Threat Modeling

Answer 4

Ensures uses held accountable for their actions You should monitor: network, system, application, user events. Maybe keystroke activity Remember that auditing impacts performance

Answer 5

Develop audit log management plan (control size, backups, reviews) Ensure ability to delete audit log requires 2 people Monitor all high level accounts Ensure audit trail includes who processed transaction, when it happened, where it happened, whether it succeeded or not Ensure deleting the log and data in it can't occur unless user has appropriate permissions

Answer 6

To identify abnormal patterns of behavior you should first identify normal patterns of behavior Establish a clipping level, a baseline of errors above which violations will be recorded Audit trails must be monitored, automatic notifications should be configured

Answer 7

Personnel - reviews standard practices and procedures that users follow Physical - reviews facility and perimeter protection System and Network - review systems, devices, network topology

Answer 8

Simulate attack to ID threats from internal or external sources that could exploit vulnerabilities of a system or device 1. document target system or device 2. gather info about attack methods including port scanning 3. ID known vulnerabilities of target 4. execute attacks against target to gain user or privileged access 5. document results of pen test, report findings with suggestions for remediation

Answer 9

Blind Test testing team given limited knowledge of the network using publicly available info. Security team knows attack is coming. This requires more work by testing team, it must simulate actual attack Double-blind Test Like blind test except Security Team doesn't know attack is coming. Requires equal effort for testing and security teams Target Test Both testing and security teams are given maximum information about network and the type of test. Easiest test to complete but won't provide full picture of organization's security

Answer 10

Zero-Knowledge Test (Black Box Test) Testing team provided with no knowledge about organization's network. They can use any means possible to learn about it. Partial-Knowledge Test Testing team provided with public knowledge about organization's network. Boundaries might be set for this type of test Full-Knowledge Test Testing team provided with all available knowledge about organization's network. This test focused more on what attacks can be carried out.

Answer 11

Lets you apply structured approach to security and address top threats that have greatest impact to your application first.

Answer 12

1. Compensative - acts as mitigation to risks. ie two signatures to release sensitive information, or 2 keys for safe deposit box 2. Corrective - reduces effect of attack. ie fire extinguishers, isolating or terminating connection, new firewall rules. 3. Detective - detects attack while it's occurring and alerts personnel. ie motion doctors, IDS, guards, job rotation, investigations 4. Deterrent - deters or discourages attackers. Often trigger preventive and corrective controls. ie User ID and authentication, fences, lighting, security policies and NDA's

Answer 13

1. Compensative - acts as mitigation to risks. ie two signatures to release sensitive information, or 2 keys for safe deposit box 2. Corrective - reduces effect of attack. ie fire extinguishers, isolating or terminating connection, new firewall rules. 3. Detective - detects attack while it's occurring and alerts personnel. ie motion doctors, IDS, guards, job rotation, investigations 4. Deterrent - deters or discourages attackers. Often trigger preventive and corrective controls. ie User ID and authentication, fences, lighting, security policies and NDA's

Answer 14

5. Directive - Specifies acceptable practice in an organization. Often is a AUP, acceptable use policy that lists proper and improper procedures 6. Preventive - Prevents attack from occurring. ie locks, badges, biometrics, encryption, IPS, antivirus, personnel security, guards, passwords, training 7. Recovery - recovers a system after an attack has occurred. ie Disaster Recovery plans, backups, offsite facilities

Answer 15

1. Administrative - administers organization's assets and personnel. ie personnel controls, data classification, data labeling, security awareness training, supervision 2. Logical (Technical) - Restricts access. ie firewalls, IDS, IPS, encryption, authentication systems, protocols, auditing, monitoring, biometrics, smart cards, passwords 3. Physical - Protects organization's facilities and personnel. ie perimeter security, badges, cards, guards, dogs, man traps, biometrics, cabling

Answer 16

Discretionary Access Control Owner of object specifies which subjects can access the resource. Access based on subject's identity, profile or role. DAC is a need-to-know control Mandatory Access Control Subject authorization is based on security labels. MAC is prohibitive because it's based on security label system. Under MAC everything not expressly allowed is denied. Only administrators can change category of a resource Role-Based Access Control Each subject assigned to one or more roles. Roles are hierarchical. Access control based on the roles. Can be used to easily enforce minimum privileges for subjects

Answer 17

Rule-Based Access Control (not role-based) facilitates frequent changes to data permissions. Using this method, a security policy is based on global rules for all users Content-Dependent Access Control makes access decisions based on data contained within the object Context-Dependent Access Control based on subject or object attributes or environmental characteristics. These characteristics can include locations or time of data

Answer 18

Access Control Matrix table that has subjects, list of objects and list of actions that a subject can take on each object. Rows in the matrix are the subjects and columns are the objects ``` Capabilities Table (for subject) A capability corresponds to a subject's row from an Access Control Matrix. A capability table lists access rights that a particular subject has to objects. A capability table is about the subject ``` ACL (for object) corresponds to an object's column from an Access Control Matrix. an ACL lists all the access rights that subjects have to a particular object. An ACL is about the object

Answer 19

Centralized Central department oversees access for all organizational resources. Ensures user access is controlled in a consistent manner across enterprise Decentralized Personnel closest to resources oversee the access control. This methods ensure that those who know the data, control the access to it.

Answer 20

Formal process for creating, changing, removing users. This includes user approval, creation, creation standards, authorization Users should always sign a statement explaining conditions and responsibilities Access modification and removal procedures should be documented User provision policies should be integrated as part of HR management. HR formally requests creation or deletion of user account

Answer 21

IDS - detects unauthorized access or attacks IPS - detects and acts to prevent and contain attack

Answer 22

Network IDS - most common. monitors network traffic Host based IDS - monitors traffic on single system. Protects system it is installed on by using audit trails and logs

Answer 23

Signature based - analyzes traffic, compares it to attack or signatures in the IDS database Anomaly based - analyzes traffic, compares it to normal traffic to determine if threat or not Rule or Heuristic based - expert system that uses knowledge base, inference engine and rule-based programming. Knowledge is configured as rules. Data and traffic analyzed and rules applied to the analyzed traffic

Answer 24

Pattern Matching compares traffic to database of attack patterns Stateful Matching records initial OS state. any changes to it that violate defined rules, result in alerts

Answer 25

statistical - samples live environment, the longer it runs the more accurate a profile will be built protocol - has knowledge of protocols it's monitoring. Profile of normal usage is built and compared traffic - IDS tracks traffic pattern changes. All future traffic patterns are compared to the sample

Answer 26

Dictionary attackers use dictionary of words to discover passwords ``` Brute Force (aka exhaustive attack) attackers work through all possible combinations of numbers and characters. ```

Answer 27

Phishing - attackers learn personal data by implementing fake website to mimic legitimate one Pharming - pollutes DNS cache of user's computer so legitimate sites are rerouted to attacker's site Shoulder surfing attacker watches when user enters login or other data Identity theft someone obtains personal information and uses it to assume identity of the victim dumpster diving attackers examine garbage to obtain confidential information

Answer 28

DOS / DDoS attackers flood device with enough requests to degrade performance of targeted device. Synflood and Teardrop Buffer Overflow Data submitted to application is larger than the buffer can handle Mobile Code Any software transmitted over a network to be executed on local system.

Answer 29

Virus - malware that attaches to other application to replicate or distribute itself Worm - malware that replicates itself without other application or human interaction Trojan Horse - malware disguised as needed application while performing malicious activity Spyware - Malware that collects private data Spoofing - when communication from attacker appears to come from trusted source

Answer 30

Virus - malware that attaches to other application to replicate or distribute itself Worm - malware that replicates itself without other application or human interaction Trojan Horse - malware disguised as needed application while performing malicious activity Spyware - Malware that collects private data Spoofing - when communication from attacker appears to come from trusted source

Answer 31

Sniffing - device or software that collects all information transmitted over the medium Emanating - electromagnetic signals that are emitted by electronic device. TEMPEST by US and UK researches ways to limit this Backdoor / Trapdoor - mechanism implemented in devices that give user root access to it

Answer 32

a domain that's managed by the same group using the same security policy A security domain builds upon the definition of a domain (set of resources available to a subject) by adding that the resources within the domain are working under the same security policy and managed by the same group Different domains are separated by logical boundaries like firewalls, directory services, etc.

Answer 33

yes They are not protocol parameters

Answer 34

no Counter-based means that the server and token share the same list of access codes and secret key. The secret key encrypts the access cord, which is the one time password the user enters for authentication

Answer 35

Asynchronous Server sends a challenge (nonce), user puts it into token which encrypts it and returns a value used as the one-time password

Answer 36

yes In this case, the clipping level is the number of allowed failed login attempts before locking out the account.

Answer 37

less. They can change over time

Answer 38

the length and format required by the application