Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP FlashCards 2021 CBK (in progress) > Domain 5 - Identity and Access Management > Flashcards

Domain 5 - Identity and Access Management Flashcards

(98 cards)

Start Studying
1
Q

Crossover Error rate

A

point where false reject rate and false accept rate equal

Represents the overall accuracy of system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

False accept rate

A

occurs when unauth subject is accepted by a biometric system as valid. AKA Type 2 error

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

False reject rate

A

when an authorized subject is falseley rejected. Type 1 error

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Type 1 authentication

A

something you know

password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

type 2 auth

A

something you have (key, keycard)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Type 3

A

something you are (biometric)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Credential set

A

term used for combination of identification and authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Passphrase

A

long password in the form of a sentance. Usually less random.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

One time passwords

A

used for single auth. Very secure but difficult to manage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

NIST 800-63B guideline

A

guidelines for password complexity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Dynamic Passwords

A

change at regular intervals. RSA Security makes a synchronous token every 60 seconds.

Expensive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Strong authentication

A

AKA Multifactor authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Password hashes and pass cracking

A

password is run through a hash and the hash is stored in DB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Linux password hashes

A

stored in etc/shadow. Only readable by root

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Windows password hash

A

stored locally and on domain controller in SAM File/security management file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Dictionary attack

A

run large list of words through hash algs to try and find collision.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Brute force attack

A

Go through the entire key space. All combos

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Hybrid attack

A

appends, prepends, or changes characters in words from a dictionary before hashing. Attempts fastest crack of complex passwords.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Rainbow table

A

large dictionary of HASHED passwords. Trandes off lower CPU resources required, for more storage required.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Salts

A

random value added to pre-hash value. Ensures the same password doesn’t have the same hash twice.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Password MGMT: Pasword history

A

remember the last 24 passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Password MGMT: Max password age

A

90

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Password MGMT: Min password age

A

2 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Password MGMT: Min password length

A

8 char

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Password MGMT: Storage
use non-reversible encryption. i.e. hashing
26
Password MGMT: Storage
use non-reversible encryption. i.e. hashing
27
Synchronous Dynamic Token
Time or Counters are synced with an auth server. Google authenticator, RSA Secureid
28
Asynchronous Dynamic Token
Not synced with a central server. Most common variet are challenge response tokens (CHAP)
29
Biometrics - accuracy
high accuracy needed
30
Biometrics - data storage
should be less than 1000 bytes
31
Enrollment
How long it takes to get biormetrics initially entered into a system for a user
32
Throughput
How long it takes to be authenticated w/biometric system
33
Throughput
How long it takes to be authenticated w/biometric system
34
Retina scan
scans back of eye
35
iris scan
picture of front of eye.
36
Hand geometry scan
measures specific points of hand. Can store data in as little as 9 bytes.
37
Keyboard dynamics
measures how you type. Not super accurate.
38
Dynamic signature
measures how someone signs their name.
39
voice print
vulnerable to replay attacks. Measures subjects tone of voice while stating a specific phrase.
40
Facial scan/recognition
really accurate.
41
centralized access control
centralized system to provide AAA services
42
Decentralized access control
AC is pushed to perimeter. Branch offices. Provides more local power. Each site has control over data.
43
DAC vs DAC
Decentralized access control or Discretionary access control.
44
SSO
Single sign on
45
SSO
Allows multiple systems to use a central auth server.
46
Allows sec admins to add, change, or revoke permissions on one central system
SSO
47
Disadvantages of SSO
difficult to retrofit Unattendand desktop is a juicier target. Gives access to more. Single point of attack.
48
Access provisioning lifecycle
lifecycle of an identity in an AAA system. Accounts for everything from onboarding through to leaving the organization.
49
IBM identity lifecycle rules
1. password policy compliance checking 2. notify users to change passwords before they expire. 3. Identify l8ifecycle changes such as accounts that haven't been used for 30 days. 4. Identify new accounts that have not been used for 10 days. 5. Identify candidates for deletion because they've been suspended for 30 days. 6. when a contract expires, identifying all accts belonging to a business partner and revoke access.
50
Authorization creep/Access Aggregation
subjects maintain old authorization while gaining new.
51
Federated identiy management
Applies SSO at a wider scale. cross organization to internet. microsoft acct, google acct, github and others.
52
SAML
XML based framework for exchanging sec info, including auth.
53
IDaaS
Identity as a services.
54
LDAP
lightweight directory access protocol. Common, open protocol for interfacing and querying directory service info. TCP/UDP 389
55
LDAPS
LDAP over TLS
56
Kerberos
third party auth service that is used for SSO AAA
57
Kerberos key distrib model
needham and Schroeder
58
needham and Schroeder key protocol
symmetric encryption alg. base of Kerberos protocol. Aims to establish secure seesion key over insecure network.
59
Kerberos SSO
secret key encryption.
60
Kerberos authentication
Mutual authentication.
61
Current kerberos version
5
62
Kerberos principal
client/user
63
Kerberos realm
logical kerberos network
64
Kerberos ticket
data that authenticates the principals identity
65
Kerberos creds
ticket + service key
66
Kerberos KDC
Key distribution center, authenticates principals
67
Kerberos TGS
ticket granting service
68
Kerberos TGT
ticket granting ticket
69
Kerberos C/S
client server. Regarding comms between the two.
70
Kerberos weaknesses
KDC Stores plaintext keys Compromise of KDC can be a compromise of every key KDC and TGS are single points of failure Replay attacks are possible for the lifetime of the authenticator.
71
SESAME
secure european system for applications in a multi vendor environment Fixes kerberos weakness of plaintext keys, by using asymmetric encryption.
72
SESAME PACs
private attribute certificate - in place of Kerberos tickets.
73
RADIUS
remote user dial in user servers
74
RADIUS RFCs
2865 and 2866
75
RADIUS Ports
1812 (auth) and 1813 (accounting) both UDP
76
RADIUS old ports
1645 1646 UDP
77
RADIUS AVP
attribute value pairs
78
Diameter
RADIUS successor
79
Diameter
32 bit AVP instead of 8 bit
80
Diameter port
TCP instead of UDP 1812, 1813
81
Diameter RFC
3588 draft, 6733 official
82
TACACS and TACACS+
UDP 49 Not backwards compatible.
83
TACACS
auth is similar to RADIUS
84
AD One way trust
active directory, trust that provides access from trusted domain to resources in teh trustnig domain
85
AD two way trust
both domains trust each other uflly
86
AD Nontransitive
Only the explicitly trusted domains have a trust relationship If I trust Domain A, and Domain A trusts Domain B. I do not trust Domain B.
87
AD Transitive
If I trust Domain A, and Domain A trusts Domain B. I also trust domain B.
88
Non discretionary Access Control
NDAC - Major difference is that NDACs are centrally administrated, and can make changes that affect the entire environment.
89
DAC -
Discretionary Access Control: Subjects may have full control of objects. i.e. I have permission to edit certain work documents. Windows, Linux and Unix use DAC
90
MAC
Mandatory Access Controls subjects and objects have clearances and labels. subject may access only objects of their clearance or lower
91
Password guessing
Online attampt to authenticate with guessed password
92
PAP
Insecure auth AAA Protocol. Cleartext
93
CHAP
Challenge Handshake Auth Protocol. More secure than PAP
94
RBAC
Role Based Access Control Users are grouped by roles (i.e. doctors, nurses). Permissions/access is granted per role, not per individual. RBAC is a Type of Nondiscretionary Access control NAC
95
Task-based Access Control
Similar to RBAC, but refined down to giving access based on the tasks/actions and end user would take. i.e. not all nurses would have the same access. Family practice nurses would not need or want the same access as a surgical nurse.
96
rule-based access control
fairly self-explanatory. Uses if/then statements to code rules.
97
Content dependent AC
Defense in depth additional layer. Takes into account the nature of the content a user is accessing. I.e. a user has access to HR records, but only their HR records
98
Context Dependent AC
Brings into consideration additional context. I.e. time or location. .

CISSP FlashCards 2021 CBK (in progress) (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions