01 - Flash Cards
1
Q
Information
A
- Organization’s information is a term that refers to all the information pertaining to the organization.
2
Q
System
A
- In this context, systems refer to IT systems used to provide services.
3
Q
Devices
A
- Broad term that may refer to computing systems, servers, laptops, smartphones and external devices such as printers.
4
Q
Subject
A
- Active entities such as users that access passive object to gain information from or about an object.
5
Q
Object
A
- Passive entities such as files and databases that provide subject with information.
6
Q
CIA Triad
A
- Confidentiality
- Integrity
- Availability
7
Q
Confidentiality
A
- Is a concept that encompasses a set of measures used to protect the secrecy of data, resources, and objects.
8
Q
Integrity
A
- Ability to protect reliability and correctness of data/information.
9
Q
Availability
A
- Refers to uninterrupted access to objects to all authorized subjects.
10
Q
Types of Access Control
A
- Preventive Access Control
- Detective Access Control
- Corrective Access Control
- Deterrent Access Control
- Directive Access Control
- Compensating Access Control
- Administrative Access Control
- Logical/Technical Control
- Physical Control
11
Q
Preventive Access Control
A
- Type of control that attempts to prevent incidents before they occur – for example firewall or a guard.
12
Q
Detective Access Control
A
- Type of control that identifies security violations after they have occurred –for example motion detectors.
13
Q
Corrective Access Control
A
- Type of controls that change the environment after an incident has occured in order to to return it to normal – for example antivirus programs.
14
Q
Deterrent Access Control
A
- Type of a control that attempts to discourage specific action from happening- for example security cameras or a security policy.
15
Q
Directive Access Control
A
- Type of administrative control that provide guidelines – for example monitoring and supervision.
16
Q
Compensating Access Control
A
- Type of a control that provides an alternative when it is not possible to use a primary control.
17
Q
Administrative Access Control
A
- Type of controls that are stated in organization’s security policy – for example background checks and training efforts.
18
Q
Logical/Technical Control
A
- Hardware and software mechanisms used to manage access and to provide protection for systems.
19
Q
Physical Control
A
- Type of control one can physically touch – for example fences and guards.
20
Q
Identification
A
- Term that refers to a subject claiming an identity.
21
Q
Authentication
A
- Term that refers to verifying subject’s identity by comparing it against a database such as user accounts.
22
Q
Authorization
A
- Term that refers to granting access to specific resources based on a proven identity.
23
Q
Accountability
A
- Term that refers to subjects responsibility for their actions once an audit is under way.
24
Q
Authentication Factors Types
A
- Type 1
- Type 2
- Type 3
25
Q
Authentication Type 1
A
- Something you know – for example a pin or a password.
26
Q
Authentication Type 2
A
- Something you have – for example a token or a smart card.
27
Q
Authentication Type 3
A
- Something you are or you do – for example fingertips or keystrokes.
28
Q
Context- Aware Authentication
A
- Context-aware authentication is the use of situational information (such as identity, location, time, type of device) to improve information security.
29
Q
Passwords
A
- Most common authentication technique that belong to Type 1 authentication.
30
Q
Strong Password Policy Settings
A
- Maximum age
- Password lengths
- Password complexity
31
Q
Password History
A
- Password history remembers a certain number of passwords and prevents a user from reusing previous passwords.
32
Q
Password Phrase
A
- Passphrase is a string of characters that has a unique meaning to a user – for example “I am awesome.”
33
Q
Cognitive Passwords
A
- Series of questions about the facts that only a subject would know.
34
Q
Smartcards
A
- Cards that have an embedded circuit chip and contain information about an authorized user.
- This information is used for identification and authentication.
35
Q
Tokens
A
- Password generating device that users carry with them.
36
Q
Token Types
A
- Synchronous Dynamic
- Asynchronous Dynamic
37
Q
HOTP
A
- HMAC includes a hash function used by HMAC-based One Time Password in order to create onetime passwords..
38
Q
TOTP
A
- Time-based One-Time Password uses a timestamp and it is valid for a certain time like 30 seconds. The password expires if the user does not use it within the frame.
39
Q
Biometrics
A
- Face scans
- Retina scans
- Iris scans
- Palm scans
- Hand geometry
- Heart/pulse patterns
- Voice pattern recognition
- Signature dynamics
- Keystroke patterns
40
Q
Biometric Factor Error Ratings
A
- False Rejection Rate - valid subject is not authenticated
- False Acceptance Rate - invalid subject is authenticated
41
Q
Multifactor Authentication
A
- Authentication method that uses 2 or more factors to provide authentication.
42
Q
Device Authentication
A
- Fingerprinting, 802.1x, user logs…
43
Q
Service Authentication
A
- Usually refers to username and password.
44
Q
Identity Management Implementation
A
- Centralized access control
- Decentralized access control
45
Q
Single Sign-On
A
- Centralized access control method that allows a user to be authenticated once and be able to use multiple resource without authenticating again.
46
Q
LDAP
A
- Lightweight Directory Access Protocol is a directory for network services and assets.
47
Q
Kerberos
A
- It is a computer network authentication protocol developed by MIT that offers sign on solution for users and provides protection for logon credentials.
48
Q
Kerberos elements
A
- Key Distribution Center
- Kerberos Authentication Server
- Ticket Granting Ticket
- Ticket
49
Q
Hypertext Markup Language (HTML)
A
- It is a major markup language used to display web pages on the internet.
50
Q
Extensible Markup Language (XML)
A
- It is a language commonly used by data-exchange services to send information between otherwise incompatible systems.
51
Q
Service Provisioning Markup Language
A
- XML-based language that facilitates the exchange of provisioning information among applications and organizations, corporations, or agencies.
52
Q
Extensible Access Control Markup Language
A
- It is an open standard XML-based language designed to express security policies and access rights to information for web services, digital rights management, and enterprise security applications.
53
Q
OAuth 2.0
A
- It is an open standard used for access delegation.
54
Q
OpenID
A
- It is an open standard and decentralized authentication protocol maintained by the OpenID Foundation.
55
Q
OpenID Connect
A
- It simple identity layer on top of the OAuth 2.0 protocol autorization framework.
56
Q
Scripted Access
A
- Logon script meant to establish communication links by providing automated process to transmit credentials at the start of a logon session.
57
Q
Credential Management System
A
- Storage space for users to keep their credentials when SSO is not available.
58
Q
AAA Protocols
A
- Authentication, Authorization and Accounting – term used to refer to a family of protocols that mediate network access such as RADIUS and Diameter
59
Q
RADIUS
A
- Remote Authentication Dial-In User Service is a client/server protocol and software that enables remote access servers to communicate with a central server to authenticate users and authorize their access to the requested system or service.
60
Q
Diameter
A
- Enhanced version of RADIUS that supports a wide range of protocols including traditional IP, Mobile IP, Voice over IP.
61
Q
TACACS+
A
- Terminal Access Controller Access-Control System refers to a family of related protocols handling remote authentication and related services for networked.
62
Q
Identity and access provisioning lifecycle
A
- It is a concept that refers to creation, management, and deletion of accounts.
63
Q
Provisioning
A
- In the context of setting a new account, provisioning refers to assigning appropriate privileges with an account.
64
Q
Account Review
A
- Review process should be done regularly to ensure that security policies are being followed.
65
Q
Account Revocation
A
- It is key to revoke accounts for terminated employees due to a risk of a sabotage.
- Many systems set expiration dates for specific accounts.
66
Q
A
