Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP FlashCards 2021 CBK (in progress) > Domain 5 - Identity and Access Management > Flashcards

Domain 5 - Identity and Access Management Flashcards

1
Q

Crossover Error rate

A

point where false reject rate and false accept rate equal

Represents the overall accuracy of system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

False accept rate

A

occurs when unauth subject is accepted by a biometric system as valid. AKA Type 2 error

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

False reject rate

A

when an authorized subject is falseley rejected. Type 1 error

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Type 1 authentication

A

something you know

password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

type 2 auth

A

something you have (key, keycard)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Type 3

A

something you are (biometric)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Credential set

A

term used for combination of identification and authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Passphrase

A

long password in the form of a sentance. Usually less random.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

One time passwords

A

used for single auth. Very secure but difficult to manage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

NIST 800-63B guideline

A

guidelines for password complexity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Dynamic Passwords

A

change at regular intervals. RSA Security makes a synchronous token every 60 seconds.

Expensive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Strong authentication

A

AKA Multifactor authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Password hashes and pass cracking

A

password is run through a hash and the hash is stored in DB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Linux password hashes

A

stored in etc/shadow. Only readable by root

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Windows password hash

A

stored locally and on domain controller in SAM File/security management file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Dictionary attack

A

run large list of words through hash algs to try and find collision.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Brute force attack

A

Go through the entire key space. All combos

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Hybrid attack

A

appends, prepends, or changes characters in words from a dictionary before hashing. Attempts fastest crack of complex passwords.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Rainbow table

A

large dictionary of HASHED passwords. Trandes off lower CPU resources required, for more storage required.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Salts

A

random value added to pre-hash value. Ensures the same password doesn’t have the same hash twice.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Password MGMT: Pasword history

A

remember the last 24 passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Password MGMT: Max password age

A

90

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Password MGMT: Min password age

A

2 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Password MGMT: Min password length

A

8 char

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Password MGMT: Storage

A

use non-reversible encryption. i.e. hashing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Password MGMT: Storage

A

use non-reversible encryption. i.e. hashing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Synchronous Dynamic Token

A

Time or Counters are synced with an auth server.

Google authenticator, RSA Secureid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Asynchronous Dynamic Token

A

Not synced with a central server. Most common variet are challenge response tokens (CHAP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Biometrics - accuracy

A

high accuracy needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Biometrics - data storage

A

should be less than 1000 bytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Enrollment

A

How long it takes to get biormetrics initially entered into a system for a user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Throughput

A

How long it takes to be authenticated w/biometric system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Throughput

A

How long it takes to be authenticated w/biometric system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Retina scan

A

scans back of eye

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

iris scan

A

picture of front of eye.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Hand geometry scan

A

measures specific points of hand. Can store data in as little as 9 bytes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Keyboard dynamics

A

measures how you type. Not super accurate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Dynamic signature

A

measures how someone signs their name.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

voice print

A

vulnerable to replay attacks. Measures subjects tone of voice while stating a specific phrase.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Facial scan/recognition

A

really accurate.

41
Q

centralized access control

A

centralized system to provide AAA services

42
Q

Decentralized access control

A

AC is pushed to perimeter. Branch offices. Provides more local power. Each site has control over data.

43
Q

DAC vs DAC

A

Decentralized access control or Discretionary access control.

44
Q

SSO

A

Single sign on

45
Q

SSO

A

Allows multiple systems to use a central auth server.

46
Q

Allows sec admins to add, change, or revoke permissions on one central system

A

SSO

47
Q

Disadvantages of SSO

A

difficult to retrofit
Unattendand desktop is a juicier target. Gives access to more.
Single point of attack.

48
Q

Access provisioning lifecycle

A

lifecycle of an identity in an AAA system. Accounts for everything from onboarding through to leaving the organization.

49
Q

IBM identity lifecycle rules

A
  1. password policy compliance checking
  2. notify users to change passwords before they expire.
  3. Identify l8ifecycle changes such as accounts that haven’t been used for 30 days.
  4. Identify new accounts that have not been used for 10 days.
  5. Identify candidates for deletion because they’ve been suspended for 30 days.
  6. when a contract expires, identifying all accts belonging to a business partner and revoke access.
50
Q

Authorization creep/Access Aggregation

A

subjects maintain old authorization while gaining new.

51
Q

Federated identiy management

A

Applies SSO at a wider scale. cross organization to internet.

microsoft acct, google acct, github and others.

52
Q

SAML

A

XML based framework for exchanging sec info, including auth.

53
Q

IDaaS

A

Identity as a services.

54
Q

LDAP

A

lightweight directory access protocol. Common, open protocol for interfacing and querying directory service info. TCP/UDP 389

55
Q

LDAPS

A

LDAP over TLS

56
Q

Kerberos

A

third party auth service that is used for SSO

AAA

57
Q

Kerberos key distrib model

A

needham and Schroeder

58
Q

needham and Schroeder key protocol

A

symmetric encryption alg. base of Kerberos protocol. Aims to establish secure seesion key over insecure network.

59
Q

Kerberos SSO

A

secret key encryption.

60
Q

Kerberos authentication

A

Mutual authentication.

61
Q

Current kerberos version

A

5

62
Q

Kerberos principal

A

client/user

63
Q

Kerberos realm

A

logical kerberos network

64
Q

Kerberos ticket

A

data that authenticates the principals identity

65
Q

Kerberos creds

A

ticket + service key

66
Q

Kerberos KDC

A

Key distribution center, authenticates principals

67
Q

Kerberos TGS

A

ticket granting service

68
Q

Kerberos TGT

A

ticket granting ticket

69
Q

Kerberos C/S

A

client server. Regarding comms between the two.

70
Q

Kerberos weaknesses

A

KDC Stores plaintext keys
Compromise of KDC can be a compromise of every key
KDC and TGS are single points of failure
Replay attacks are possible for the lifetime of the authenticator.

71
Q

SESAME

A

secure european system for applications in a multi vendor environment

Fixes kerberos weakness of plaintext keys, by using asymmetric encryption.

72
Q

SESAME PACs

A

private attribute certificate - in place of Kerberos tickets.

73
Q

RADIUS

A

remote user dial in user servers

74
Q

RADIUS RFCs

A

2865 and 2866

75
Q

RADIUS Ports

A

1812 (auth) and 1813 (accounting) both UDP

76
Q

RADIUS old ports

A

1645 1646 UDP

77
Q

RADIUS AVP

A

attribute value pairs

78
Q

Diameter

A

RADIUS successor

79
Q

Diameter

A

32 bit AVP instead of 8 bit

80
Q

Diameter port

A

TCP instead of UDP 1812, 1813

81
Q

Diameter RFC

A

3588 draft, 6733 official

82
Q

TACACS and TACACS+

A

UDP 49 Not backwards compatible.

83
Q

TACACS

A

auth is similar to RADIUS

84
Q

AD One way trust

A

active directory, trust that provides access from trusted domain to resources in teh trustnig domain

85
Q

AD two way trust

A

both domains trust each other uflly

86
Q

AD Nontransitive

A

Only the explicitly trusted domains have a trust relationship

If I trust Domain A, and Domain A trusts Domain B. I do not trust Domain B.

87
Q

AD Transitive

A

If I trust Domain A, and Domain A trusts Domain B. I also trust domain B.

88
Q

Non discretionary Access Control

A

NDAC - Major difference is that NDACs are centrally administrated, and can make changes that affect the entire environment.

89
Q

DAC -

A

Discretionary Access Control:

Subjects may have full control of objects. i.e. I have permission to edit certain work documents. Windows, Linux and Unix use DAC

90
Q

MAC

A

Mandatory Access Controls subjects and objects have clearances and labels.
subject may access only objects of their clearance or lower

91
Q

Password guessing

A

Online attampt to authenticate with guessed password

92
Q

PAP

A

Insecure auth AAA Protocol. Cleartext

93
Q

CHAP

A

Challenge Handshake Auth Protocol. More secure than PAP

94
Q

RBAC

A

Role Based Access Control

Users are grouped by roles (i.e. doctors, nurses). Permissions/access is granted per role, not per individual.

RBAC is a Type of Nondiscretionary Access control NAC

95
Q

Task-based Access Control

A

Similar to RBAC, but refined down to giving access based on the tasks/actions and end user would take.

i.e. not all nurses would have the same access. Family practice nurses would not need or want the same access as a surgical nurse.

96
Q

rule-based access control

A

fairly self-explanatory. Uses if/then statements to code rules.

97
Q

Content dependent AC

A

Defense in depth additional layer.

Takes into account the nature of the content a user is accessing. I.e. a user has access to HR records, but only their HR records

98
Q

Context Dependent AC

A

Brings into consideration additional context. I.e. time or location. .

CISSP FlashCards 2021 CBK (in progress) (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions