Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Access Control > Flashcards

Access Control Flashcards

1
Q

Which statement correctly describes biometric methods? A. They are the least expensive and provide the most protection. B. They are the most expensive and provide the least protection. C. They are the least expensive and provide the least protection. D. They are the most expensive and provide the most protection.

A

D. Compared with the other available authentication mechanisms, biometric methods provide the highest level of protection and are the most expensive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Authorization Creep

A

What is authorization creep*? (permissions accumulate over time even if you don’t need them anymore) Auditing authorization can help mitigate this. SOX requires yearly auditing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Access Controls

A

Access controls are security features that control how people can interact with systems, and resources. Goal is to protect from un-authorized access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Access

A

The data flow between an object and a subject.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Access Control Subject

A

Is a person, process or program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Object

A

Is a resource (file, printer etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Components of Access Control

IA3

A
  1. Identification – who am I? (userid etc)
  2. Authentication – prove that I am who I say I
  3. Authorization – now what am I allowed to access
  4. Auditing – Big Brother can see what I accessed.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Authentication Proving who you say you are, usually one of these 3.

A

Something you know (password)

Something you have (smart card / token)

Something you are (biometrics)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Identity Management

A

Identity management products are used to id, authenticate and authorize users in an automated means. It’s a broad term. These products may (or may not) include User account management Access controls Password management Single Sign on Permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Directories

A

Information about the users and resources LDAP (based on X.500)

Key concept is namespaces (like branches of a tree) and DN (distinguished names) Can anyone explain namespaces and DNs? DN=CN and multiple DCs can include OUs

Active Directory (an implementation of LDAP) Legacy NT (flat directory structure) Novell Netware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A Federation ADFS

A

A Federation is multiple computing and/or network providers agreeing upon standards of operation in a collective fashion.

(self governing entities that agree on common grounds to easy access between them) A federated Identity is an identity and entitlements that can be used across business boundaries.

(MS passport, Google checkout) Active Directory Federated Services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

DAC

A

Discretionary Access Control

Owner or creator of resource specifies which subjects have which access to a resource. Based on the Discretion of the data owner* Common example is an ACL

(what is an ACL?) Commonly implemented in commercial products (Windows, Linux, MacOS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

MAC

A

Mandatory Access Control

Data owners cannot grant access!* OS makes the decision based on a security label system*

Users and Data are given a clearance level (confidential, secret, top secret etc)*

Rules for access are configured by the security officer and enforced by the OS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Rules Based Access Control

A

RBAC

Is considered a “compulsory control” because the rules are strictly enforced and not modifiable by users. Routers and firewalls use Rule Based access control heavily.

RBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Access Control Technology / Techniques

A

Constrained User Interfaces* view, shell, menu, physical Access Control Matrix* Capability Tables* ACL* Content Dependant Access Control Context Dependant Access Control You should really know ALL of these and be able to differential between similar types!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Context-Dependent Access Control

A

Makes access decisions based on the context of a collection of information rather than on the sensitivity of the data.

A system that is using context-dependent access control “reviews the situation” and then makes a decision. For example, firewalls make contextbased access decisions.. syn + syn-ack + ack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Content-Dependent Access Control

A

Access to objects is determined by the content within the object.

18
Q

Access Control Models

A

DAC MAC RBAC

DAC - Discretionary Access Control (DAC) is a type of access control in which a user has complete control over all the programs it owns and executes, and also determines the permissions other users have those those files and programs.

MAC - Mandatory Access Control (MAC) is a type ofaccess control in which only the administrator manages the access controls. The administrator defines the usage and access policy, which cannot be modified or changed by users, and the policy will indicate who has access to which programs and files.

RBAC - Role-based access control (RBAC) is an approach to restricting system access to authorized users.

19
Q

The DAC model enables data owners to allow other users to access their resources.

A

The DAC model enables data owners to allow other users to access their resources.

20
Q

Access Control Techniques

Access control techniques are used to support the access control models.

  • Access control matrix Table of subjects and objects that outlines their access relationships
  • Access control list Bound to an object and indicates what subjects can access it and what operations they can carry out
  • Capability table Bound to a subject and indicates what objects that subject can access and what operations it can carry out
  • Content-based access Bases access decisions on the sensitivity of the data, not solely on subject identity
  • Context-based access Bases access decisions on the state of the situation, not solely on identity or content sensitivity
  • Restricted interface Limits the user’s environment within the system, thus limiting access to objects
  • Rule-based access Restricts subjects’ access attempts by predefined rules
A

Access Control Techniques

Access control techniques are used to support the access control models.

  • Access control matrix Table of subjects and objects that outlines their access relationships
  • Access control list Bound to an object and indicates what subjects can access it and what operations they can carry out
  • Capability table Bound to a subject and indicates what objects that subject can access and what operations it can carry out
  • Content-based access Bases access decisions on the sensitivity of the data, not solely on subject identity
  • Context-based access Bases access decisions on the state of the situation, not solely on identity or content sensitivity
  • Restricted interface Limits the user’s environment within the system, thus limiting access to objects
  • Rule-based access Restricts subjects’ access attempts by predefined rules
21
Q

Access Control Techniques are used to?

A

Access control techniques are used to support the access control models.

22
Q

Access control matrix

A

Access control matrix A Table of subjects and objects that outlines their access relationships

23
Q

RADIUS

A

Remote Authentication Dial-In User Service (RADIUS) is a network protocol that provides client/server authentication and authorization, and audits remote users.

24
Q

Rule-based access

A

Restricts subjects’ access attempts by predefined rules

25
Q

RADIUS

A

Remote Authentication Dial-In User Service (RADIUS)

A network protocol that provides client/server authentication and authorization, and audits remote users.

26
Q

TACACS

A

Terminal Access Controller Access Control System (TACACS)

Combines its authentication and authorization processes; XTACACS separates authentication, authorization, and auditing processes; and TACACS+ is XTACACS with extended two-factor user authentication. TACACS uses fixed passwords for authentication, while TACACS+ allows users to employ dynamic (one-time) passwords, which provides more protection.

27
Q

RADIUS

A
28
Q

Which Document assigns individual roles and responsibilities?

A

Acceptable use policy

29
Q

The main purpose of Change control/mamagement system?

A

Document change for audit and management review

30
Q

Risk is commonly expressed as a function of the likelihood that harm will occur and its potential impact.

A

Risk is commonly expressed as a function of the likelihood that harm will occur and its potential impact.

31
Q

Communications security management and techniques prevents, detects, and corrects errors so that the integrity, availability, and confidentiality of transactions over networks may be maintianed.

A

Communications security management and techniques prevents, detects, and corrects errors so that the integrity, availability, and confidentiality of transactions over networks may be maintianed.

32
Q

Risk Analysis is Most useful when applied during

A

Project Identification

33
Q

Fundamental components of a Regulatory Security Policy

A

WHAT is to be done.

WHEN it is to be done.

WHY is it to be done.

34
Q

BIBA Model

A

No Write UP

No Read DOWN

35
Q

The MOST critical characteristic of a biometrics system?

EA2T

A

Enrollment time

Accuracy

Acceptability

Throughput rate

36
Q

FIPS-140

Is a standard for the security of?

A

Federal Information Processing Standard (FIPS)

Hardware and software cryptographic Modules

37
Q

DSV

A

Dynamic Signature Verification

38
Q

Elements of BCP

A

Obtaining senior managements approval of the results

Creating an awareness of the plan

Updating the plan regularly and as needed

39
Q

Components of CC protection

A

Threats against the product that must be addressed

Security objectives

Target of Evaluation (TOE) description

40
Q

International Standard for the Common Criteria

IS15408

A

International Standard for the Common Criteria

IS15408

41
Q
A

CISSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions