ch1 Flashcards
(48 cards)
what is a FER?
False error rate
define availability
Availability ensures that systems are up and operational when needed and often addresses single points of failure. You can increase availability by adding fault tolerance and redundancies, such as RAID, failover clusters, backups, and generators.
define security control
measures taken to mitigate risk from a threat to services, IT critical system, etc. It is also important to know that every security control belongs to a category and a type defined by CompTIA.
define integrity
integrity ensures that data has not changed. this includes verifying that data has not been tampered with, modified, or corrupted.
describe least privilege principle
it is the practice of giving the least amount of permissions or access rights necessary for the person to do their job. it is an example of a technical control. technical control is a category of security controls
describe what OAuth is
open standard for authorization.
give examples of technical controls
anti-virus, encryption, firewalls, least privilege principle, intrusion detection systems, intrusion prevention systems,
how are managerial and operational controls related?
managerial controls are administrative in nature and documented in an organization’s security policies. operational controls relate to day to day operations of an organization and meant to comply with the documented security policies. operational controls are implemented by personel.
name the 4 types of authentication factors
- something you know i.e. password, pin
- something you have i.e. security token, or phone
- something you are i.e. biometric attribute
- somewhere you are - typically this fourth factor is not used as an authentication factor by itself.
name the technique used to ensure data integrity
hashing, e.g. using hashing algorithms such as md5 or sha
what account types are there in the context of account management?
- Personnel or end-user accounts. Most accounts are for regular users or the personnel working in the organizations. Administrators create these accounts and then assign appropriate privileges based on the user’s job responsibilities. It’s common to assign a basic credential policy that applies to all personnel. This could be a password policy defining things like the minimum password length, password history, and account lockout policies, as defined earlier in this chapter.
- Administrator and root accounts. Administrator and root accounts are privileged accounts that have additional rights and privileges beyond what a regular user has. As an example, someone with administrator privileges on a Windows computer has full control over the Windows computer. Linux systems have a root account, which grants additional privileges, similar to an administrator account on Windows systems. Credential policies require stronger authentication methods for these privileged accounts, such as multifactor authentication. Additionally, privileged access management techniques (described in the next section) apply additional controls to protect these accounts.
- Service accounts. Some applications and services need to run under the context of an account, and a service account fills this need. As an example, SQL Server is a database application that runs on a server, and it needs access to resources on the server and the network. Administrators create a regular user account, name it something like sqlservice, assign it appropriate privileges, and configure SQL Server to use this account. Note that this is like a regular end-user account. The only difference is that it’s used by the service or application, not an end user. Credential policies may require long, complex passwords for these accounts, but they should not expire. If the password expires, the account can no longer log on, and the service or application will stop.
- Device accounts. Computers and other devices also have accounts though it isn’t always apparent. As an example, Microsoft Active Directory only allows users to log on to computers joined to the domain. These computers have computer accounts and Active Directory manages their passwords.
- Third-party accounts. Third-party accounts are accounts from external entities that have access to a network. As an example, many organizations use security applications that have administrative access to a network. These should have strong credential policies in place with strong password policies enforced at a minimum.
- Guest accounts. Windows operating systems include a Guest account. These are useful if you want to grant someone limited access to a computer or network without creating a new account. For example, imagine an organization contracts with a temp agency to have someone do data entry. The agency may send a different person every day. Enabling the Guest account for this person would be simpler than creating a new account every day. Administrators commonly disable the Guest account and only enable it in special situations. Shared and generic account/credentials. An organization can create a regular user account that temporary workers will share.
- Shared accounts are discouraged for normal work. However, if a temp agency is sending someone different every day, a shared account may provide a better solution than a guest account because access can be tailored for the shared account. Basic credential policies apply to shared and generic accounts.
what are sensitivity labels?
these are labels used in a MAC scheme and each label includes security information which can include: classification level, compartment/category
example
Classification Level: “Top Secret”
Compartment/Category: “Nuclear Power Plant”
Sensitivity Label: “Top Secret – Nuclear Power Plant”
what are the 3 goals of cybersecurity?
- confidentiality
- availability
- integrity
what are the authorization models covered by security+?
role based access control - this model is used to determine what users are allowed access to depending on the role assigned to them
rule based access control - this model is used by routers and firewalls to determine what web or https requests are allowed to go through depending on rules defined by the router or firewall
discretionary access control AKA DAC- this model is used by operating systems to determine what level of access users have to objects depending on DACL. access is controlled by the owner of the object.
mandatory access control AKA MAC - most commonly used by OS’s i.e. SELinux to control access to files and resources for users. it is based on matching sensitivity labels between the subject and object. access is centrally controlled by administrators.
attribute based access control AKA ABAC
what are the types of strong authentication factors recognized by CompTIA?
- something you know: password, pin, security questions
- something you have: smart card, keyfob, smartphone, usb drive
- something you are: biometrics i.e. fingerprint scan, face recognition, voice recognition
what are time base logins?
users can only log on to computers during specific times. If a user tries to log on to a system outside the restricted time, the system denies access to the user.
what is a 3rd party account in context of account management?
Third-Party Account:
Ownership: A third-party account is typically created and managed by an external organization or service provider, not by the organization or individual using the system. This type of account is associated with an external entity that has been granted access to a system or service.
Purpose: Third-party accounts are used when external vendors, contractors, or service providers need access to a system or network to perform specific tasks, such as support, maintenance, or integration with another service. These accounts are used to facilitate collaboration or service delivery between organizations.
Access Level: The access level for third-party accounts is usually defined very carefully, often limited to what is necessary for the third party to perform their duties. This might include access to certain systems, data, or tools, but with strict controls to protect the organization’s security and privacy.
Management: Third-party accounts are often subject to more stringent monitoring and auditing. They may have special agreements, such as non-disclosure agreements (NDAs) or service level agreements (SLAs), outlining how the account should be used.
what is a CER?
crossover error rate - A lower CER indicates that the biometric system is more accurate.
what is a federated identity?
A federated identity is an identity that is recognized and trusted across multiple domains or organizations through a federated identity management system (FIM). The FIM links user identities across different systems, allowing users to access various services and resources with a single set of credentials, enabling Single Sign-On (SSO) and streamlining the authentication process across multiple platforms.
what is a guest account in the context of account management?
Guest Account:
Purpose: A guest account is typically used for temporary access by individuals who do not have a regular or long-term need to access the system. It’s often used for visitors or external users who need limited access for a short duration.
Access Level: Guest accounts generally have very limited permissions. They are restricted to basic functions, often without the ability to modify system settings or access sensitive data.
Duration: Access through a guest account is usually temporary, and the account may have time-based restrictions, expiring after a certain period or after a specific use.
Personalization: Guest accounts usually do not retain personal settings, data, or files after the session ends, ensuring that the next guest starts with a clean slate.
what is a MAC in context of authentication?
message authentication code: it is a code derived from a message to provide data integrity
what is a MAC in context of physical machine property?
Media Access Control is a physical address assigned to a machine’s network interface card.
what is an attestation?
Formal process for reviewing user permissions. In an attestation process, managers formally review each user’s permissions and certify that those permissions are necessary to carry out the user’s job responsibilities.
what is an FAR?
False acceptance rate - it is a measure of the accuracy of a biometric identification system or device.
