CISSP Domain 5 Flashcards
1
Q
Identity and Access Management
A
Identification methods and technologies
Authentication methods, methods, models, technologies
Accountability, monitoring, and auditing practices
Registration and proof of identity
Identity as a service
Threats to access control practices and technologies
2
Q
Access is
A
the flow of information between a subject and an object
3
Q
A subject is
A
an active entity that requests access to an object or data within an object
4
Q
Availability
A
Information, systems, and resources must be available to users in a timely manner so productivity will not be affected
5
Q
Integrity
A
Information must be accurate, complete, and protected from unauthorized modification
6
Q
Confidentiality
A
assurance that information will not be disclosed to unauthorized individuals, programs, or processes
7
Q
Identification
A
describes a method by which a subject claims and identity. Username, account number, email address
8
Q
Authentication
A
Proof the subject is the one with the identity claimed
A second piece of a credential set
9
Q
Authorization
A
The system determines the subject has permission to access the object
10
Q
Accountability
A
The subject is identified, authenticated, authorized, and actions are recorded
11
Q
Race Condition
A
When processes carry our tasks on a shared resource in an incorrect order.
when two or more processes use the same resource and the sequence of steps withing the software can be carried our in an improper order
12
Q
Factors for Authentication
A
Something a person knows
Something a person has
something a person is
Knowledge
Ownership
Characteristic
13
Q
Secure identities
A
uniqueness
Nondescript
issuance
14
Q
User provisioning
A
creation,, maintenance, and deactivation of user objects and attributes
15
Q
Biometric type one error
A
False Rejection Rate
FRR
16
Q
Biometric type two error
A
False Acceptance Rate
17
Q
Crossover Error Rate
A
also called equal error rate (EER)
18
Q
Salts
A
random values added to the encryption process to add ore complexity and randomness
19
Q
Cognitive passwords
A
fact or opinion based information used to verify an individuals identity
20
Q
One Time Password
A
also called dynamic password
used only once
asynchronous and Asynchronous
21
Q
Synchronous token
A
uses time or a counter
22
Q
Asynchronous Token
A
employs a challenge response scheme
random value called a nonce
23
Q
Memory Cards and Smart card difference
A
capacity to process information
Memory card holds information, but cannot process
Smart card holds information and can process
24
Q
Smart Card types
A
contact and contactless
Contact has a seal or chip
Contactless has antenna wire
antenna generates power
25
Kerberos
based on symmetric key cryptography
eliminates need to transmit passwords over the network
Most implementations work with shared secret keys
26
Kerberos four elements for enterprise access control
Scalability
Transparency
Reliability
Security
27
Key distribution Center (KDC)
holds all users and services secret keys
provides authentication as well as key distribution
trust is the foundation of kerberos security
28
Kerberos provides security service to
Principles
| can be users, applications, or network services
29
Kerberos must have
an account for and share a secret key with each principal
30
Kerberos password is transformed into
a secret key value
31
Kerberos ticket service
is generated by the ticket granting service (TGS)
Serves as CA like PKI
32
When a user logs into Kerberos
Credentials passed to Authentication service on the KDC.
| User gets a ticket granting ticket
33
Kerberos Ticket Granting TIcket
Once user is authenticated to AS (Authentication Service)
User gets a ticket granting ticket
Ticket is sent to Ticket granting Service
Instead of sending passwords over the network, the Ticket Granting Ticket is sent to the Ticket Granting Service
TGT has a time limit
34
Reason to use Kerberos
principals do not trust each other enough to communicate directly
Similar to PKI. TGS serves as CA
35
Weak
KDC can be a single point of failure
must respond in a timely manner.
must be scalable
Secret keys are temporarily stored on user workstations
Kerberos is subject to password guessing
Network traffic is not protected by kerberos is encryption is not enabled
Short keys are vulnerable to brute-force attacks
Kerberos needs client and server clocks to be synchronized
36
Digital Identity
facts, or attributes, of a user
37
Federated identity
can be used across multiple domains
a portable identity
allows a user to be authenticated across multiple systems and enterprises
Is a key component of e commerce
38
Web portal
parts of a website that act as a point of access to information
presents information from diverse sources in a unified manner
can offer various services, including email and news
39
Web portals are made up of
portlets which are plugable user interface software components
A portal is made up of individual portlets
40
HTML came from
Standard Generalized Markup Language
41
Extensible Markup Language
a universal, functional standard
42
SPML
Service Provisioning Markup Language
allowed exchange of provisioning data between applications
Could reside in one organization or many.
Allows for automation of user management and access entitlement configuration related to electronically published services.
43
SPML 3 main entities
Requesting Authority
Provisioning service Provider
Provisioning Service Target
44
SPML requesting authority
entity making a request to setup an account
45
SPML Provisioning Service Provider
software that responds to account requests
46
SPML Provisioning Service Target
Carries out the provisioning activities on the requested system
47
SAML
Security Assertion Markup Language
| XML standard that allowed exchange of authentication and authorization data to be shared between 2 security domains
48
SAML provides
authentication pieces to federated identity management systems to allow business to business and business to consumer transactions
49
Web Services
collection of technologies and standards that allow services to be provided on distributed systems
50
Transmission of SAML data
SOAP
a specification that outlines how information pertaining to web services is exchanged in a structured manner
Provides a basic messaging framework.
51
SOAP
Simple Object Access Protocol
SOAP
a specification that outlines how information pertaining to web services is exchanged in a structured manner
Provides a basic messaging framework.
52
SOA
Service Oriented Architecture
| Provide independent services residing on different systems in different domains
53
Extensible Access Control Markup Language
XACML
used to express security policies and access rights to assets provided through web services
Sends authentication information
54
Open ID
standard for user authentication by third parties
credentials are not maintained by the company, but a third party such as Google, Yahoo, or Facebook
Frees up website developers from the need to setup authentication mechanisms
55
Open ID roles
End User
Resource Party
Open ID provider
56
OAuth
Open standard for authorization to third parties
57
Identity as a Service
type of software as a service
| provides SSO, Federated IdM, password management
58
Access Control Models
framework that dictates how subjects access objects
59
Three types of access control models
Discretionary
Mandatory
Role Based
60
Constrained User Interfaces
restrict user abilities by not allowing certain functions
61
Three major types of Constrained User Inferfaces
Menus and shells
database views
physical constrained interfaces
62
Access Control Matrix
table of subjects and objects indicating what actions individual subjects can take upon individual objects
63
Capability Table
Specifies access rights a certain subject possesses pertaining to specific objects
64
Content dependent access control
filters according to strings
65
RADIUS
Remote Authentication Dial In User Service
Network protocol that provides client/server authentication, and authorization, and audits remote users
66
TACACS
Terminal Access Controller Access Control System
Combines its authentication and authorization processes
67
Three generations of TACACS
TACACS, Extended TACACS, and TACAS+
TACACS combines authentication and authorization
XTACACS separates authentication, authorization processes,
TACACS+ is XTACACS with 2 factor
68
TCACS vs TACACS+
TACACS uses fixed passwords
TACACS+ allows users to employ dynamic passwords
69
RADIUS encryption
RADIUS only encrypts password only as it is being transmitted from the RADIUS client to server.
Username, accounting and authorized services are transmitted in clear text.
RADIUS is subject to replay attacks
70
TACACS+ encryption
TACACS encrypts all authentication data between the client and server
71
Diameter
builds upon the functionality of RADIUS
| Is another AAA protocol but provides more flexibility and capabilities
72
Mobile IP
allows a user to move from one network to another with the same IP address.
Allows a user to have a home IP Address
73
Two portions of diameter
first is base protocol that provides secure and communication among Diameter entities, feature discovery, and version negotiation
Second is extensions built on top of base protocol to allow various technologies to use.
74
Diameter provides AAA functionality
Authentication
PAP, CHAP, EAP
End to end protection of authentication information
Replay attack protection
Authorization
Redirects, secure proxies, relays, and brokers
State reconciliation
Unsolicited disconnect
Reauthorization on demand
Accounting
Reporting, roaming operations, accounting, event monitoring
75
Access Control Layers
Administrative Controls
Physical Controls
Technical Controls
76
Tempest
started out as a DOD study and turned into a standard that outlines how to develop countermeasures.
TEMPEST remediates picking up information through the airways.
77
Alternatives to TEMPEST
white noise or control zone
78
IDS
designed to detect a security breach
| Process of detecting unauthorized use or attack on a computer network
79
IDS components
Sensors
Analyzers
Administrator interfaces
80
State based IDS
Every change is a state transition.
Logon, application, etc
State is a snapshot
81
Statistical Anomaly IDS
behavioral based system
| In learning mode to build a profile of an environment's normal
82
Expert System
Rule based IDS made up of a knowledge base, inference engine and rule based programming
83
Honeypot
computer setup as a sacrificial lamb on the network
| no locked down, ports enabled.
84
Pharming
redirects a victim to a seemingly legitimate site. Attacker then carries out DNS poisoning
85
War dialing
allows attackers and administrators to dial large blocks of phone numbers in search of modems
86
Vulnerability scans find
potential vulnerabilities Penetration testing is required to identify vulnerabilities that can be exploited
87
Common Vulnerabilities
```
Kernal flaws
Buffer Overflows
Symbolic Links
File Descriptor attacks
Race conditions
File and directory permissions
```
88
Kernel flaws
below the level of the user interface
| Countermeasure: Ensure that security patches, after testing, are applied to keep the window of opportunity small
89
Buffer Overflows
bugs allowing more input than the program has space for. Overwrites data at the end of a buffer allows attacker to inject program code and cause processor to execute it. Gives attacker the same level of access as the program
Countermeasure
developer education, automated source code scanners, enhanced programming libraries and strongly typed languages that disallow buffer overflows
90
Symbolic Links
A program follows a link. Attacker can compromise the link. Might be used to delete or edit a password database
Countermeasure
Programs, and especially scripts, must be written to ensure the full path to the file cannot be circumvented
91
File Descriptor Attacks
Numbers many operating systems use to represent open files in a process. Violated by unexpected input to provided to the program
Countermeasure
Good programming and developer education, automated source code scanners, and application testing reduce vulnerability
92
Race condition
Design of a program puts it in a vulnerable condition before ensuring those conditions are mitigated.
Countermeasure
Good programming practices and developer education. automated source code scanners and application security testing reduce this type of vulnerability
93
File and directory permissions
errors in access control
Countermeasures
File integrity checkers
94
Log reviews
Examination of system log files to detect security events or to verify the effectiveness of security controls
95
Network Time Protocol
time is sent in a UDP datagram that carries a 64 bit time stamp to port 123
96
Preventing Log tampering
```
Remote Logging
Simplex communication
Replication
Write Once Media
Cryptographic hash
```
97
Network Time Protocol stratums
Stratum 0 Government standard
Stratum 1 core (maybe ISP)
Stratum 2 another core, maybe domain
Stratum 3 etc passes down for synchronization
98
Synthetic Transactions
Transaction generated by a script systematically test the behavior and performance of critical services
99
Real User Monitoring RUM
differs from synthetic transactions passively.
