Acc Ctrl Flashcards
3 primary types of access control
preventive, detective, and corrective.
secondary types of access control
There are also four other access control types, commonly known as deterrent, recovery, directive, and compensation access controls
process by which a subject professes an identity and accountability is initiated
Identification
process of verifying or testing that a claimed identity is valid
Authentication
indicates who is trusted to perform specific operation
Authorization
which AAA protocol is done via auditing, logging, and monitoring, ensures that subjects can be held accountable for their actions. Auditing is the process of tracking and recording subject activities within logs
Accountability
RSA token is what kind of token (sync/async, static/dynamic)?
is a synchronous dynamic password token. It generates passwords at fixed time intervals, such as every 60 seconds
(sync or async) dynamic password token does not use a clock; it generates passwords based on an occurrence of some event. These tokens often generate a password after the user enters a PIN into the token device.
asynchronous
Which access control model? Every object has an owner, owners have full control over their objects. Permissions are maintained in an ACL, and owners can easily change permissions.
Discretionary access control (DAC)
Which access control model? Access does not focus on user identity. Instead, a static set of rules governing the whole environment is used to manage access
Non-Dac
Rule-based access controls and lattice-based access controls are both considered ….
non-dac
Which access control model?relies upon the use of classification labels. Each classification label represents a security domain, or a realm of security.
MAC
SSO solution for login, symmetric key crypto, AES encryption protocol. Provides confidentiality AND integrity for authentication.
Kerberos
AAA protocols
provide authentication, authorization, and accounting (sometimes ID is included). typically used for VPN and other centralized access controls.
3 common AAA protocols are …
RADIUS, TACACS+, and Diameter.
various TYPES of access control (7):
Preventive, Detective, corrective, recovery, directive, compensation, recovery.
birthday attack
birthday attack focuses on finding collisions. similar to finding two pswds with same hash. Ex = 50 ppl in room, 2 will have same bday.
a variant of phishing that uses the phone system or VoIP. A common attack uses an automated call to the user explaining a problem with a credit card account.
Vishing
name 4 different password attacks:
dictionary attacks, brute-force attacks, rainbow table attacks, and sniffer attacks
What attack uses….all possible combinations of keyboard characters used.
brute-force
What attack uses…. a predefined list of possible passwords possibly used
dictionary attack.
Sym or Asym…..cryptosystems use a shared secret key available to all users of the cryptosystem.
symmetric
Sym or Asym … cryptosystems utilize individual combinations of public and private keys for each user of the system
Asymmetric
AND function
returns TRUE only when X&Y are TRUE. 1+1=1, else 0
OR function
returns FALSE when X&Y are FALSE. 0-0=0, else 1.
NOT operation (~ or !)
opposite.
XOR ⊕ function
return TRUE is both are same.
Cipher that uses an encryption algorithm to rearrange the letters of a plaintext message, forming the ciphertext message
Transposition
Ciphers that use the encryption algorithm to replace each character or bit of the plaintext message with a different character
Subsititution
one time pad
powerful type of substitution cipher. One-time pads use a different substitution alphabet for each letter of the plaintext message. (EX:ceasar, Vigenere)
Cipher where the encryption key is as long as the message itself and is often chosen from a common book
book cipher or running key cipher
A kind of cipher that operate on “chunks,” or blocks, of a message and apply the encryption algorithm to an entire message block at the same time.
Block cipher
A kind of cipher that operate on one character or bit of a message (or data stream) at a time.
Steam cipher
Asymmetric key encryption
integrity, authentication, and non-repudiation. + /- of users easy, .regen of key incases of compromise is easy and fast
Common Symmetric Cryptosystems
Data Encryption Standard (DES), Triple DES (3DES), International Data Encryption Algorithm (IDEA), Blowfish, Skipjack, and the Advanced Encryption Standard (AES)
AES cipher
The AES cipher allows the use of three key strengths: 128 bits, 192 bits, and 256 bits.
Diffie-Hellman
symetric key encryption used when offiline distribution nor public key encrypt are sufficient. Diffie-Hellman is an algo where 2 parties provide random values and extract key from: “K = S^r mod p”
zero knowledge proof
Zero-knowledge proof is a communication concept. A specific type of information is exchanged but no real data is transferred, as with digital signatures and digital certificates.
importance of key importance
Modern cryptosystems utilize keys that are at least 128 bits long to provide adequate security. It’s generally agreed that the 56-bit key of the Data Encryption Standard (DES) is no longer sufficiently long enough to provide security.
4 modes of DES:
Electronic Codebook (ECB), Cipher Block Chaining (CBC) mode, Cipher Feedback (CFB), and Output Feedback (OFB) mode. ECB is least secure.
AES
Utilizes the Rijndael algorithm The US government standard Uses key lengths of 128, 192, and 256 bits and a fixed block size of 128 bits Better than older DES algorithm.
Take-Grant
Take-Grant model may also adopt a create rule and a remove rule to generate or delete rights. The key to this model is that using these rules allows one to figure out when rights in the system can change and where leakage (i.e., unintentional distribution of permissions) can occur.
Access control matrix
table of subj and objs. col= acl.row= capability
Goguen-Meseguer model
is an integrity model. The Goguen-Meseguer model is based on predetermining the set or domain—a list of objects that a subject can access. This model is based on automation theory and domain separation.
Sutherland model
the model is based on the idea of defining a set of system states, initial states, and state transitions. Through the use of and limitations to only these predetermined secure states, integrity is maintained and interference is prohibited
