S16-Logical Security Flashcards
1
Q
Identity and Access Management (IAM)
A
Identification, Authentication and authorization mechanisms for users and computers
2
Q
What are IAM endpoints?
A
- Desktops
- Laptops
- Tablets
- Cellphones
- etc.
3
Q
Roles
A
Identifying an asset by defining the resource an asset has permission to access based on the function the asses fulfills
4
Q
What things can roles be assigned too?
A
- Servers
- People
- Endpoints
5
Q
What are some IAM tasks?
A
- Directory Services and repositories
- Access management tools
- Auditing and reporting systems
6
Q
Goals and Functions of iAM
A
- Create and deprovision accounts
- Manage accounts
- Audit accounts
- Evaluate identity-based threats
- Maintain compliance
7
Q
Multifactor Authentication
A
Authenticates or proves an identity using more then 1 method
8
Q
what are the different forms of authentication?
A
- Something you know
- Somethin you have
- something you are
- something you do
- something you are
9
Q
Something you know
A
Knowledge factor
- Eg. password, username
10
Q
Something you have
A
Possession Factor
- Eg. smartcards, RSA key fobs, RFID tags
11
Q
something you are
A
Inherence Factor
- Eg. Fingerprints, retina scans, voice prints
12
Q
something you do
A
Action Factor
- Eg. How you sign your name
- how you draw a pattern
- how you say a catch phrase
13
Q
somewhere you are
A
Location Factor
- Geotagging
- Geofencing
14
Q
Dictionary attack
A
Guesses the password by attempting to check every single word or phrase contained within a word list, called a dictionary
15
Q
Brute Force attack
A
Tries every possible combo until the password is cracked
16
Q
Hybrid Attack
A
Combination of dictionary and brut force attacks
17
Q
Authentication
A
The process of determining whether someone or something is who or what it claims itself to be
18
Q
Lightweight Directory Access Protocol (LDAP)
A
A database that is used to centralize information about the clients and the objects on the network
19
Q
what port does LDAP use?
A
Port 389 (Plain texts version)
Port 636 (Secure)
20
Q
Active Directory (AD)
A
Organizes and manages everything on the network, including clients, servers, devices, and users
21
Q
Kerberos
A
Focused on authentication and authorization within a windows domain environment
- Uses a ticketing system on your domain controller
22
Q
What port does Kerberos use?
A
Port 88
23
Q
Single Sign-On (SSO)
A
Authentication method where users can have a single strong password or utilize multi-factor authentication
24
Q
Security Assertion Markup Language (SAML)
A
simplifies the authentication process for users and enables SSO by allowing the IdP to manage user identities and credentials, and the SP to verify those credentials and grant access.
25
what is IdP (SAML)?
"Identity Provider"
Manages user identities and authenticates users.
26
What is SP (SAML)?
"Service Provider"
The application or service the user wants to access.
27
What is a SAML Assertion?
A secure, XML-based message containing information about the user's identity and authorization, sent from the IdP to the SP.
28
Remote Authentication Dial-In User Service (RADIUS)
a networking protocol that provides centralized authentication, authorization, and accounting (AAA) for users accessing a network or service
29
What communication types can RADIUS support?
- Dial-up
- VPN
- Wireless Auth.
- 802.1x
- Extensible Auth. Protocol (EAP)
30
What ports does RADIUS use?
Authentication Messages
- Port 1812
- 1645 (proprietary versions)
Accounting Messages
- Port 1813
- 1646 (proprietary versions)
31
Terminal Access Controller Access Control System Plus (TACACS+)
Proprietary Cisco network security protocol that provides centralized authentication, authorization, and accounting (AAA) services for network devices
32
T/F TACACS+ & RADIUS both support all Protocols
False, TACACS+ supports all Protocols, RADIUS does not.
33
What are some Protocols does RADIUS not support?
- Remote Access
- NetBIOS Frame
- X.25 PAG connections
34
Time-Based Authentication (TOTP)
Security Mechanism that generates a temporary, dynamic password or token that is valid only for a short period
35
Least Privilege
a security principle that dictates users, processes, and applications should only be granted the minimum access necessary to perform their designated tasks
36
Discretionary Access Control (DAC)
access control method where access is determined by the owner of the resource
37
DAC drawbacks
- Every Object needs an owner
- Each owner must determine access rights for each object
38
Mandatory Access Control (MAC)
AN access control policy where the computer system gets to decide who gets access to what
39
How does MAC decide user access?
Through DATA labels and a trust level system
40
Role-Based Access Control (RBAC)
System controlled access that focuses on permissions
41
Unencrypted data
Cleartext, Plaintext
42
Encrypted Data
Ciphertext
43
Data State
Location of data within a processing system
44
what are the 3 data states?
- Rest
- Motion
- Processing
45
Data at Rest
Any Data that is stored in memory, or a storage device
46
Data in Motion
Any data moving from one system to another over the network or within the same system
47
Protection for Data at rest
- Full Disk Encryption
- Folder Encryption
- File Encryption
- Database Encryption
48
Protection For Data in transit
- Transport Layer Security (TLS)
- Secure Socket Layer (SSL)
- IPSec
- L2TP
- WPA2 with AES
49
Data In Use/Processing
Any data read into memory or is currently inside the processor and being worked on or manipulated
50
IP Security (IPSec)
a framework of protocols designed to secure data transmission over IP networks. It's often used in VPNs and provides authentication, data integrity, and confidentiality through encryption.
51
IPSec protections and methods
Confidentiality:
- Data Encryption
Integrity:
- Ensures data is unmodified during transit, Hashing
Authentication:
- Verify participating parties
Anti-Replay:
- Checks sequence numbers on all Packets prior to transmission
52
IPSec Steps
1 - Key Exchange
2 - IKE Phase 1
3 - IKE Phase 2
4 - Data Exchange
5 - Termination
53
IKE Phase 1
- IPSec peers have their identities authenticated and encrypted.
- Then a negotiation for a matching IKE SA (internet key Exchange security association)
- Peers perform an authenticated Diffie-Hellman Key exchange so both sides have a copy
54
What 2 modes can IKE Phase 1 use?
- Main Mode
- Aggressive Mode
55
Main Mode (IKE P1)
Conducts three, two-way exchanges between the peers
1 - Agree on which Algorithms and hashes to use
2 - Use Diffie-Hellman exchange to generate shared secret keys
3 - Verify the identity of both sides through the encrypted form of the other's IP address
56
Aggressive Mode (IKE P1)
Uses Fewer Exchanges, resulting in fewer packets and faster connection.
57
What Information is contained inside an IKE SA?
- Authentication Used
- Encryption & Hashes Algos.
- Diffie-Hellman Groups used
- IKE SA Expiration
- Shared Secret Key values for encryption Algos.
58
What is The Diffie-Hellman key exchange algorithm?
a cryptographic protocol that allows two parties to establish a shared secret key over an insecure network without directly transmitting the key itself.
59
IKE Phase 2
- Negotiate the IPSec SA parameters protected by an existing IKE SA
- Establish IPSec SA
- Periodically Renegotiate IPSec SAs
- Perform Additional Diffie-Hellman Exchanges
60
Quick Mode (IKE P2)
Occurs after IKE P1. actual encryption and authentication parameters for protecting network traffic are negotiated and security associations (SAs) are established.
61
Transport Mode
Uses Packet's original IP Header to be used for client-to-site VPNs
- Ideal for Client to Site
62
Tunneling Mode
Encapsulates the entire packet and puts another header on top of it
- Ideal for Site to Site
63
Authentication Header (AH)
Provides connectionless data integrity and data origin authentication of IP datagrams and provides protection against replay attacks
64
Encapsulating Security Payload (ESP)
Provides Authentication, Integrity, Replay protection, and data confidentiality
65
Public Key Infrastructure (PKI)
An entire system of hardware, Software, policies, procedures, and people that is based on asymmetric encryption.
- creates the asymmetrical key pairs that consist of public and private keys that are used in the encryption and decryption process
- Asymmetric encryption and decryption system
66
Public Key Cryptography
a system where two keys are used for encryption and decryption: a public key and a private key
- Asymmetric encryption and decryption process
67
Certificate Authority
Issues digital certificates and keeps the level of trust between all of the certificate authorities around the world
68
Key Escrow
Process where cryptographic keys are stored in a secure, third-party location, which is effectively an "Escrow"
69
Digital Certificate
Digitally signed electronic document that binds a public key with a user's identity
70
What standard do Digital Certificates use inside of PKI ?
X.509 protocol standard
71
Wildcard Certificate
Allows all of the subdomains to use the same public key certificate and have it displayed as valid
72
Subject Alternate Name (SAN) Field
Certificate that specifies what additional domains and IP addresses are going to be supported
73
Single-Sided Certificate
Only Requires the server to be validated
74
Dual-Sided Certificate
Requires both the server and user to be Validated
75
Self-Signed Certificate
An entity claims its own identity and vouches for itself
76
Third-Party Certificate
Digital cert. issued and signed by a trusted Certificate Authority (CA)
77
Root of Trust
Each cert. is validated using the concept of a root of trust or the chain of trust
78
What are some third-party trusted providers?
- Verisign
- Amazon
- Goggle
- CloudFlare
79
Certificate Authority (CA)
Trusted Third-party that issues digital certs.
80
Registration Authority (RA)
a trusted entity within a Public Key Infrastructure (PKI) that verifies the identity of individuals or organizations seeking digital certificates
81
Certificate Signing Request (CSR)
A block of encoded text that contains information about the entity requesting the certificate
82
What type of information is contained in a CSR?
- Organization name
- Domain Name
- Locality
- Country
83
Certificate Revocation List (CRL)
Online list of digital certs. that the CA has revoked
84
Key Escrow
Secure copy of a user's private key is stored
85
Key Recovery Agent
Specialized type of software that allows the restoration of a lost or corrupted key to be performed
86
Key management
Refers to how an organization will generate, exchange, store and use encryption keys
