Chapter 2 Identity and Access management

Question 1

A service account is used by? and what is their password policy?

Answer 1

A service or application, not an end-user. Password does not expire (service will shutdown), but should be complex.

Question 2

What is a third-party account for? what is an example?

Answer 2

For external parties that require access to the network. This may include security software that requires administrator privileges.

Question 3

What is PAM? and what are the benefits?

Answer 3

Privileged access management, used to increase security, privileges are only accessed when required. Limits time of access, change passwords periodically, don’t need to know password (for the user at the time) as access is given to them & logs all usage.

Question 4

Is there a situation where users should share accounts?
A. Yes
B. No - security risk, can’t track users.
C. It depends

Answer 4

C. Personnel should not, but companies that come in to do a specific type of work can share an account between their employees to do so.

Question 5

What should be done with default accounts (guest accounts) when not being used?
A. Restricted access
B. Disabled

Answer 5

B

Question 6

Why are accounts disabled as opposed to wiped/deleted/removed?

Answer 6

Incase they have private keys that are required.

Question 7

In these situations, what happens to their accounts?
1. Employee is terminated
2. Leave of absence
3. Account is deleted

Answer 7

1. Account is disabled immediately once it is no longer in use.
2. Disabled while they are away
3. Account policy has dictated after X amount of days, accounts to be deleted.

Question 8

What are the different SSO methods?

Answer 8

Kereboros, Federation, SAML, OAuth, OpenID

Question 9

What is Kerboros, its uses and benefits? and briefly how it works?

Answer 9

SSO for networks, Windows and Unix. Requires strong mutual auth, KDC gives user a ticket, ticket accepted by network, time limit set (works for 10 hours), prevents on-path attacks.

Question 10

What unites different operating systems and networks (SSO)? how are these united?

Answer 10

Federation, the two to be ‘united’ agree and exchange a federated identity management database.

Question 11

What is SAML used for?

Answer 11

web browsers, web portals allowing logins to one place that lets them onto another place as well. Organizations must trust each other to allow this authentication across different websites.

Question 12

What is OAuth used for?

Answer 12

connecting multiple accounts, i.e using amazon and then using paypal to pay for it, connects these accounts together.

Question 13

What is the difference between each briefly, 1) role-based, 2) rule-based 3) Discretionary access control (DAC) 4) MAC and 5) ABAC?

Answer 13

Role - based on role

Rule - based on approved lists (like ACL in routers/firewalls), or if Bart is absent, Marge can access etc.

DAC - at MY discretion, as it is MY folder (every object as an owner), I will allow XYZ to read/write/copy or just read etc.

MAC - Based on security clearance, is it public, secret, top secret etc. Military styles.

ABAC - based on attributes, typically includes 4 things, a subject, an object, an action, and environment. Allow X to work on Y by doing Z in environment R.

Question 14

Conditional access vs ABAC?

Answer 14

Conditional access uses If-Then statements based on policies. I.e required multifactor auth to log in, If yes, Then, allow. Is device home IP, desktop? yes, then don’t allow.