Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Cyber Security > Identity and Access Management (IAM) > Flashcards

Identity and Access Management (IAM) Flashcards

(72 cards)

Start Studying
1
Q

access

A

ability to make use of any information system resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

access authority

A

entity responsible for monitoring and granting access privileges for other authorized entities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

access control

A

mediation of subject and object interactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

access control list

A

object based description of a single resource and the permission of each subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

access control matrix

A

object based description of a system or multiple resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

access control triple

A

type of access control specification in which a user, program, and data items are listed for each allowed operation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

access level

A

hierarchical portion of the security level used to identify data sensitivity and user clearance or authorization. Note: The access level and the non-hierarchical categories form the sensitivity label of an object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

access period

A

segment of time, generally expressed on a daily or weekly basis, during which access rights prevail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

access time minimization

A

risk-reducing principle that attempts to avoid prolonging access time to specific data or to the system beyond what is needed to carry out requisite functionality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

access type

A

nature of an access right to a particular device, program, or file (read, write, execute, append, modify, delete, or create)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

accessibility

A

ability to obtain the use of a computer system or a resource or the ability and means necessary to store data, retrieve data, or communicate with a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

accountability

A

responsibility of a user for the actions taken by their account which requires unique identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

account management

A

process of requesting, establishing, issuing, and closing user accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Administrative

A

control type- that is communication based, typically written or oral. Paperwork, cannot hurt adversary.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Attribute -based Access Control (ABAC)

A

Policy a function of a subject’s characteristics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Authentication

A

binary decision by a system of permitting or denying access to the entire system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Authorization

A

granular decision by a system of permitting or denying access to a particular resource on the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Blind testing

A

evaluation of a system without prior knowledge by the tester

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Capability Tables

A

subject based description of a system or a collection of resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Compartmentalize

A

to segregate for the purposes of labeling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Compensating

A

control category - more than one control on a single asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Content Dependent Access Control

A

system mediation of access with the focus on the context of the request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Control

A

tool which mediates access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Control category

A

most granular organization of controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Control type
less granular organization of controls
26
Corrective
control category- to restore to a previous state by removing the adversary and or the results of their actions
27
Denial of Service
consume resources to a point of exhaustion, loss of availability
28
Detective
control category- to record an adversary's actions
29
Deterrent
control category- to discourage an adversary from attempting to access
30
Directive
control category- to give instructions or inform
31
Discretionary
owner directed mediation of access
32
Domain
sphere of influence
33
Double blind testing
of a system without prior knowledge by the tester or the tested
34
Extended TACACS (XTACACS)
a client/server protocol developed in 1990 by Cisco. Separates authentication, authorization, and accounting.
35
Identification
to assert or claim credentialing to an authentication system
36
Intrusion Detection Systems
controls for logging and alerting
37
Intrusion Prevention Systems
controls for termination of attempt to access object
38
Kerberos
authentication protocol which only uses symmetric session keys between principals distributed by a 3rd party using different preshared symmetric keys
39
Keystroke Logging
recording activities at the keyboard level. Threat adversarial.
40
Labeling
to set the clearance of a subject or the classification of an object
41
Least privilege
just enough access to do the job
42
Mandatory
system directed mediation of access with labels
43
Marking
physical description on the exterior of an object that communicates the existence of a label
44
Masquerading
claiming another's identity at a physical level. Threat adversarial
45
Need-to-know
requirement of access to data for a clearly defined purpose
46
Non-discretionary
system directed mediation of access without labels and not reprogrammable at run time, typically refering to physical devices, not technical systems.
47
Object
passive system resource
48
Password cracking
to reveal authentication credentials. Threat adversarial
49
Penetration testing
authorized security personnel using the tools and techniques of attackers to determine vulnerabilities of systems for the purpose of remediation planning
50
Permission
authorization for a subject to interact with an object
51
Physical
control type- tangible barrier to entry. Will hurt adversary.
52
Preventive
control category- to stop the adversary before system access
53
Privacy-Aware Role Based Access Control
system mediation of access with the focus on the object's privacy
54
RADIUS
Remote Authentication Dial in User Service - a client/server protocol that provides authentication and authorization for remote users. Provides accounting capabilities. Transport uses UDP. Encryption for Password only. Authentication and authorization is combined.
55
Recovery
control category- to restore to a previous state with some data loss
56
Risk-adaptive access control (RAdAC)
Policy changes dynamically based on the risk environment
57
Role Based Access Control
system mediation of access with the focus on the function or role of the subject
58
Rule Based Access Control
system mediation of access with the focus on the function either group concept or source & destination
59
SESAME
authentication protocol which uses both asymmetric and symmetric keys
60
Shoulder Surfing
to physically view another's keyboard and monitor activities. Threat adversarial
61
Single Sign-On
one account is used for many resources. Authentication services threat.
62
Social Engineering
to convince another to take an inappropriate action through manipulation. Threat adversarial
63
Spoofing
claiming another's identity at a technical level. Threat adversarial
64
Subject
active system entity
65
TACACS
Terminal Access Controller Access Control System - a client/server protocol that was developed to control who could use dial-up lines.
66
TACACS+
Terminal Access Controller Access Control System Plus - a Cisco-proprietary protocol developed to provide access control for routers, network access servers, and other network devices via one or more centralized servers. Transport uses TCP. Encryption for entire body of packet. Authentication and authorization is separated.
67
Targeted testing
narrow scope examination of a system
68
Technical (Logical)
control type - hardware and or software mechanisms which require system interaction to gain access. Adversary must choose to interact.
69
Temporal Isolation
system mediation of access with the focus on the time of day
70
Trojan Horse
an application with a secondary purpose or execution unknown to the user, which uses the account of the user to gain access or control of a system
71
Authentication Services (Controls)
Proper registration/enrollment Protect databases 2FA Account expirations Password manager/vault
72
Authentication Services (Threats)
User Password Management Adversarial Single Sign On

Cyber Security (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions