GCGA Ch.2 Understanding Identity and Access Management

Question 1

Authentication

Answer 1

proves an identity with some type of credentials, such as a username and password. Identification occurs when someone makes a claim about their identity w/ unique identifiers (username/email). Users prove it with a password.

Question 2

Authorization

Answer 2

provides access to resources based on proven identity.

Question 3

Accounting

Answer 3

tracks user activity, records it in logs. Allows security admins to create an audit trail.

Question 4

Audit trail

Answer 4

allows security professionals to re-create the events that preceded a security incident.

Question 5

Authentication methods

Answer 5

something you know (password, PIN), something you have (smart card, phone, USB token), something you are (biometrics), somewhere you are (home, office) - are, place, have, know (APHK)

Question 6

KBA

Answer 6

Knowledge-Based Authentication - method of authenticating individuals based on what they know

Question 7

Static KBA

Answer 7

you answer questions about yourself, such as dog’s name or mother’s maiden name

Question 8

Dynamic KBA

Answer 8

queries public/private data sources like credit reports, vehicle registrations, property records

Question 9

HOTP & TOTP

Answer 9

HMAC-based one-time password & time-based one-time password - open-source standards used to generate one-time-use passwords; HOTP passwords do not expire until used; TOTP generates one-time passwords that expire after a specified period of time (typically 30-60s)

Question 10

FAR

Answer 10

False acceptance rate - identifies % of times false acceptance occurs

Question 11

FRR

Answer 11

False rejection rate - identifies % of times false rejections occur

Question 12

CER

Answer 12

Crossover error rate - indicates biometric system’s quality. Lower CER is better.

Question 13

Best practices for accounts

Answer 13

don’t share accounts/passwords, most orgs make sure Guest acct disabled

Question 14

PAM

Answer 14

Privileged access management - implements stringent security controls over accounts with elevated privileges, such as administrator or root accounts

Question 15

Account disablement policy

Answer 15

ensures that inactive accounts are disabled (for employees who resign/are terminated).

Question 16

Account audit

Answer 16

looks at rights & permissions assigned to users; enforces least privilege principle

Question 17

SAML

Answer 17

Security Assertion Markup Language - XML-based standard used to exchange authentication/authorization info between parties

Question 18

OAuth

Answer 18

open standard for authorization; allows users to log on with another account, i.e. Google, Facebook, PayPal, Microsoft, etc.; uses API calls to exchange info and a token to show access is authorized.

Question 19

Role-BAC

Answer 19

role-based access control - uses roles to grant access by placing users into roles based on their assigned jobs, functions, or tasks.

Question 20

Group-based privileges

Answer 20

a form of role-BAC. Administrators create groups, add users to the groups, and then assign permissions to the groups.

Question 21

Rule-BAC

Answer 21

rule-based access control - based on a set of approved instructions, such as ACL rules in a firewall. Some rule-BAC implementations use rules that trigger in response to an event, such as modifying ACLs after detecting an attack.

Question 22

DAC

Answer 22

Discretionary access control - every object has an owner. The owner has explicit access and establishes access for any other user. Microsoft NTFS uses the DAC scheme, with every object having a discretionary access control list (DACL). The DACL identifies who has access and what access they are granted.

Question 23

MAC

Answer 23

Mandatory access control - uses security or sensitivity labels to identify objects (what you’ll secure) and subjects (users). It is often used when access needs to be restricted based on a need to know. The administrator establishes access based on predefined security labels. These labels are often defined with a lattice to specify the upper and lower security boundaries.

Question 24

ABAC

Answer 24

Attribute-based access control - evaluates attributes and grants access based on these attributes’ values. It is used in many software-defined networks (SDNs).

Question 25

Four factors of authentication

Answer 25

Something you know, such as a username and password Something you have, such as a smart card or token Something you are, using biometrics, such as fingerprints, vein scans, facial scans, and gait analysis Somewhere you are, such as your home or office

Question 26

password managers

Answer 26

store and simplify the use of credentials for users. When users access websites needing credentials, the system automatically retrieves the stored credentials and submits them to the website.

Question 27

push notifications & 2FA

Answer 27

Push notifications are often used for 2FA. Users find them user-friendly and non-disruptive because they can verify their authentication by pressing a screen button.

Question 28

Account lockout policies

Answer 28

lock out an account after a user enters an incorrect password too many times. This helps prevent brute force and dictionary attacks.

Question 29

Default passwords

Answer 29

should be changed on any applications or devices before putting them into service.

Question 30

Single-Factor Authentication, Dual-Factor Authentication, and Multifactor authentication

Answer 30

includes one or more authentication methods that use the same factor, such as a PIN and a password (both something you know). Dual factor (or two-factor) authentication uses two factors of authentication, such as a token key (something you have) and a PIN (something you know). Multifactor authentication uses two or more factors and is stronger than any form of single-factor authentication.

Question 31

shared accounts

Answer 31

Users should not share accounts, and most organizations ensure the Guest account is disabled. Shared accounts prevent effective identification, authentication, authorization, and accounting.

Question 32

Admin account policies

Answer 32

Account policies often require administrators to have two accounts (an administrator account and a standard user account) to prevent privilege escalation and other attacks.

Question 33

Time-based logins (or time-based restrictions)

Answer 33

prevent users from logging on or accessing network resources during specific hours. Location-based policies prevent users from logging on from certain locations.

Question 34

SSO

Answer 34

Single sign-on (SSO) allows users to authenticate with a single user account and access multiple resources on a network without authenticating again.

Question 35

SSO & federated identity

Answer 35

SSO can be used to provide central authentication on the Internet with a federated database. A federated identity links a user’s credentials from different networks or operating systems, but the federation treats it as one identity.