Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Access Control > Flashcards

Access Control Flashcards

1
Q

Access Control Systems include

A

File Permissions, Program Permissions and Data Rights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

File Permissions allows

A

Create, Read, Edit or Delete on a File Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Program Permissions allows

A

execution of a program on a server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Data Rights allows

A

right to retrieve or update information in a database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A “SUBJECT” is

A

an ACTIVE entity i.e., an individual or process that accesses an OBJECT.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

An “OBJECT” is

A

a PASSIVE entity i.e., system or process that a SUBJECT ACTS UPON or accesses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

PREVENTIVE controls are for

A

reducing risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

DETECTIVE controls are for

A

identifying violations and incidents.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

CORRECTIVE controls are for

A

remedying violations and incidents and improving existing preventive and detective controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

DETERRENT controls are for

A

discouraging violations and dissuading malicious activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

RECOVERY controls are for

A

restoring systems and information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

COMPENSATING controls are for

A

providing alternative ways of achieving a task.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Preventive controls together with and overall security program are compensated by

A

DETECTIVE, CORRECTIVE, DETERRENT, RECOVERY and COMPENSATING controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

ACCESS controls can be

A

Administrative, Technical, and Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ADMINISTRATIVE controls include

A

policies and procedures that are implemented as part of an overall information security strategy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Types of ADMINISTRATIVE controls may include

A

policies, standards, guidelines and procedures. Security awareness training. Asset clarification and control. Employment policies. Account administration. Account, log and journal monitoring. Review of audit trails.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

TECHNICAL controls are

A

technical ( or logical ) controls that leverage HW or SW to implement access control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

PREVENTIVE TECHNICAL controls include

A

encryption, access control mechanisms, access control lists ( ACLs), Remote Access authentication protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Common technical ENCRYPTION controls are

A

DES ( Data Encryption Standard ) AES ( Advanced Encryption Standard ) and Merkle-Hellman Knapsack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Access Control Mechanisms are

A

Biometrics, Smart Cards, and Tokens.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Access Control Lists ( ACLs ) are

A

permission defining what a SUBECT can or cannot do to an object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Remote Access Authentication Protocols are

A

PAP ( Password Authentication Protocol ) CHAP ( Challenge HandShake Authentication Protocol ) RADIUS ( Remote Authentication Dial In User Service ) and LDAP ( Lightweight Directory Access Protocol )

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

DETECTIVE TECHNICAL controls include

A

Violation reports, Audit Trails, Network Monitoring and Intrusion Detection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

PHYSICAL controls ensure

A

safety and security of the physical environment they are primarily PREVENTIVE AND DETECTIVE.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

PHYSICAL PREVENTIVE controls include

A

perimeter protections like; fences, locked entry, restricted area and guards / dogs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

PHYSICAL DETECTIVE controls include

A

Motion detection and video cameras

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

ACCESS CONTOL SYSTEMS provide what three essential services?

A

Authentication, Authorization, and Accountability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

AUTHENTICATION is

A

( who can log in ) a two step process of Identification and Authentication or ( I&A).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

IDENTIFICATION is the means by which

A

a user ( SUBJECT ) presents a specific ID ( like a USERNAME ) to a system ( OBJECT )

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

AUTHENTICATION is the process of verifying

A

an identity… IDENTIFICATION ( I of I&A) . A USERNAME ( identity) is verified with a PASSWORD ( authentication ).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What determines a SUBECT can LOG in

A

AUTHENTICATION

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

AUTHORIZATION or “establishment” defines

A

rights and permissions granted to a user account or process. ( what can be done with a system or resource )

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What determines a what a SUBECT can do with assigned rights and permissions.

A

AUTHORIZATION

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

ACCOUNTABILITY is the capability to associate users and processes with

A

ACTIONS ( what they did ) AUDIT TRAILS AND SYSTEM LOGS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

“This” determines what a SUBJECT did

A

ACCOUNTABLITY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

The ability to irrefutably associate a user with an action that can’t be denied is

A

NON-REPUDATION

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are the two categories of ACCESS CONTROL

A

SYSTEM ACCESS / DATA ACCESS controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

SYSTEM ACCESS controls provide

A

the first line of defense for data contained in a system. This is renowned as AUTHENTICATION but include AUTHORIZATION and ACCOUNTABILITY.

39
Q

AUTHENTICATION is based on 3 FACTORS

A

something YOU KNOW ( PASSWORD and PINs ), YOU HAVE ( TOKEN or SMART CARD ) YOU ARE ( FINGERPRINT, VOICE, a physical body part )

40
Q

TWO FACTOR authentication requires

A

two of the three.

41
Q

STRONG authentication requires

A

at least TWO factors.

42
Q

Using THREE FACTORS is

A

3 FACTOR authentication.

43
Q

I & A techniques include

A

passwords/ phrases, PINS, BIOMETRICs, and OTP, Tokens, and SSO.

44
Q

Common or shared accounts as root, admin, or system are examples of accounts that have

A

no accountability and should not be permitted.

45
Q

The ACT of claiming a specific identity is

A

IDENTIFICATION

46
Q

The ACT of verifying a specific identity is

A

AUTHENTICATION

47
Q

The most common and weakest type of AUTHENTICATION is

A

the password.

48
Q

More difficult to hack the PASSPHRASE uses

A

a sequence of characters or words that are usually easier to remember.

49
Q

The downside of PASSPHRASE can be

A

inconvenient to implement ( too long ), system limitations for more than 8 characters or spaces. In the end a passphrase can be considered a password.

50
Q

General challenges with PASSWORDS and PASSPHRASES are

A

insecure, easily broken, inconvenient, refutable.

51
Q

Passwords or Passphrases are generally insecure because

A

human nature to select easy password. Transmission and storage in clear text.

52
Q

Passwords or Passphrases are easily broken by

A

BRUTE FORCE attacks, such as John the Ripper and L0phtCrack

53
Q

Passwords should demonstrate the following security best practices

A

LENGTH of six to eight characters. COMPLEXITY combination of upper lower case, special characters, AGING, which requires changes at regular intervals. HISTORY, allowing historical memory of up to 5 previous passwords, and LIMITED ATTEMPTS, defined number of unsuccessful log on attempts before lock out. LIMITED TIME PERIODS restrictions to when a user can log in, time of day. SYSTEM MESSAGES; LOGIN BANNER defining terms of use, and LAST USERNAME ( which should be disabled ) LAST SUCCESSFUL LOGIN unveils unlikely log in attempts.

54
Q

PINS are relatively weak authentication because

A

there are only 10,000 possible combinations to a four digit PIN.

55
Q

BIOMETRICs are based on THIRD FACTOR AUTHENTICATION which is

A

something YOU ARE. It is not considered STRONG authentication as it only uses one of three authentication requirements.

56
Q

BIOMETRICS access controls can be

A

PHYSICAL, presenting a biometric characteristic to be verified against a database. LOGICAL entry of a username or password plus a biometric characteristic.

57
Q

EFFECTIVE BIOMETRIC systems demonstrate

A

ACCURACY, SPEED and THROUGHPUT, DATA STORAGE REQUIREMENTS, RELIABILITY, ACCEPTABILITY

58
Q

ACCURACY in BIOMETRICS is defined by

A

FALSE REJECT RATES ( FRR) TYPE 1 ERROR and FALSE ACCEPTANCE RATE TYPE 2 ERROR

59
Q

( ! ) FALSE REJECT RATE ( FRR ) TYPE 1 ERROR

A

is the percentage of authorized users to whom the system incorrectly denies access.

60
Q

( ! ) FALSE ACCEPT RATE ( FAR ) TYPE 2 ERROR

A

is the percentage of unauthorized users to whom the systems incorrectly grants access.

61
Q

( ! ) CROSSOVER ERROR RATE

A

is the point at which the FRR equals the FAR stated as a percentage. It is considered the most important measure of BIOMETRIC accuracy.

62
Q

( ! ) The most common difficulty with BIOMETRIC systems is

A

gaining user acceptance.

63
Q

COMMON TYPES of PHYSIOLOGICAL access control systems include

A

Fingerprint recognition and scan, Hand geometry, Retina pattern, Iris pattern.

64
Q

COMMON TYPES of BEHAVIORAL access control systems include

A

Voice, Signature dynamics, Keystroke or Typing dynamics.

65
Q

ONE TIME PASSWORD is valid for

A

one log-on session only, after the session the PW is no longer valid. They provide maximum security for access control. ( TOKENS and S/KEY are types of OTP )

66
Q

TOKENS are

A

two factor authentication ( something you have and something you know ) key fobs, dongles, smart cards, soft tokens, that store static passwords ( digital certificate ) or generate dynamic passwords.

67
Q

The THREE general types of TOKENS are

A

STATIC PASSWORD ( digital certificate ) SYNCHRONOUS DYNAMIC PW ( timed event ) ASYNCHRONOUS DYNAMIC PW.

68
Q

SINGLE SIGN ON addresses

A

multiple systems and multiple logins. Address human factor of poor password implementation / selection and productivity impact on user and IT maintenance team.

69
Q

SSO challenges are

A

unrestricted access to multiple systems once logged in , and complexity to deploy the services.

70
Q

SSO leverages these common third party ticket based services.

A

KERBEROS, SESAME, KRYPTOKNIGHT

71
Q

In Kerberos two types of keys are

A

a SESSION KEY ( dynamic ) and a SECRET KEY

72
Q

A SESSION KEY ( dynamic ) is

A

generated when needed and shared between two principals then destroyed as no longer need.

73
Q

A SECRET KEY is

A

a static key that is used to encrypt a session key.

74
Q

SEASAME =

A

SECURE EUROPEAN SYSTEM and APPLICATIONS in a Multi-vendor Environment.

75
Q

SEASAME is a

A

ticket based system developed by the EUROPEAN COMPUTER MANUFACTURERS ASSOCIATION. ECMA

76
Q

KRYPTOKNIGHT

A

ticket and key distribution system developed by IBM and provides two party authentication, key distribution and data integrity services.

77
Q

( ! ) Three examples of TICKET BASED SSO services for AUTHENTICATION ARE

A

KERBEROS, SESAME, KRYPTOKNIGHT

78
Q

Access Control Methodologies are generally classified as

A

CENTRALIZED or DECENTRALIZED

79
Q

( ! ) CENTRALIZED ACCESS CONTROL examples include

A

LDAP ( Lightweight Directory Access Protocol ), RAS ( Remote Access Service ), RADIUS ( Remote Authentication Dial-in User Service ), DIAMETER, TACACS ( Terminal Access Controller Access Control System ),

80
Q

REMOTE ACCESS SERVICE leverages Point to Point Protocol ( PPP ) to encapsulate IP packets and uses the following three authentication protocols

A

PAP ( Password Authentication Protocol ), CHAP ( CHALLENGE HANDSHAKE AUTHENTICATION PROTOCOL ), EAP ( Extensible Authentication Protocol )

81
Q

DECENTRALIZED ACCESS CONTROL includes

A

multiple domains and trust, databases controlled by a DataBase Management System.

82
Q

( ! ) A Database view is

A

a type of constrained user interface. Restricting access to specific functions by not allow requests of those functions.

83
Q

Data Access Controls include

A

DISCRETIONARY ACCESS CONTOL, and MANDATORY ACCESS CONTOL

84
Q

( ! ) Who determines access policy in DISCRETIONARY ACCESS CONTROL

A

OWNER

85
Q

TWO CONCEPTS of DISCRETIONARY Access Control are

A

File and Data Ownership / Access Rights and Permissions

86
Q

TWO CONCEPTS of MANDATORY Access Control are

A

Sensitivity Labels / Data Import Export

87
Q

( ! ) What determines access policy in MANDATORY ACCESS CONTROL

A

SYSTEM

88
Q

ACCESS CONTROL MODELS are

A

BELL - LA PADULA, BIBA, CLARK-WILSON, NonINTERFERRENCE MODEL, ACCESS MATRIX MODEL, INFORMATION FLOW MODEL.

89
Q

BELL - LA PADULA defines two properties

A

Simple Security property ( ss property ) and *-property ( start property )

90
Q

( ! ) BELL - LA PADULA addresses

A

CONFIDENTIALITY

91
Q

( ! ) BIBA and CLARK WILSON addresses

A

INTEGRITY

92
Q

ACCESS CONTOL ATTACKS are

A

Brute-Force or Dictionary Attack, Buffer or Stack overflow, Man in the Middle, Packet Sniffing, Session Hijacking, Social Engineering.

93
Q

Tactics to deploy against Access Control attacks are

A

Threat Modeling, Asset Valuation, Vulnerability Analysis, and Access Aggregation.

94
Q

Access Control Evaluation and Testing include

A

Port Scanning, Application Scanning, Blackbox testing, Whitebox testing, Greybox teststing, Host Scanning, Operating system detection.

CISSP (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions