Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP rvnsquad > Access Controls > Flashcards

Access Controls Flashcards

1
Q

¿Qué significan las siglas IAAA?

A

Identification / Authentication / Authorization / Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

¿A qué se refiere el término “Identification”?

A

Making a claim

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

¿A qué se refiere el término “Authentication”?

A

Allows users to support the claim of their identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

¿Qué es “Identity and Access Management?

A

Services/ Policies/ procedures for managing a digital identity/provisioning.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

¿A qué se refiere el término “Authorization”?

A

Confirms than an authenticated entity has the privileges and permissions necessary.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

¿Qué significa el acrónimo CRUD?

A

Create / Read/ Update/ Delete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

¿Cuáles son los modelos de control de acceso más comúnes?

A
  • DAC, Discretionary Access Control
  • MAC, Mandatory Access Control
  • RBAC, Role Based Access Control
  • RUBAC, Rule Based Access Control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

¿A qué se refiere el término “Accountability”?

A

Tracing an action to a subject, also known as auditing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

¿En qué consiste el modelo DAC?

A

Discretionary Access Control

  • Security of an object is at the owner’s discretion
  • Identity based, who you are?
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

¿En qué consiste el modelo MAC?

A

Mandatory Access Control

  • Data owners cannot grant access
  • Labels
  • Users and data are given a clearance level (confidential, secret, top secret)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

¿En qué consiste el modelo RBAC?

A

Each role as a set of rights and permissions which cannot be changed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

¿Cuáles son los tipos (factores) de autenticación?

A

Type 1: something you know
Type 2: something you have
Type 3: something you are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

¿What’s a cognitive password?

A

Son preguntas del tipo: ¿a qué escuela fuiste?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

¿Cuál es el objetivo de los “clipping levels?

A

reduce administration overhead

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Ejemplo de factores de autenticación tipo 2:

A
  • Token
  • Smart Card
  • Memory Card
  • HW Key
  • Certificate
  • Cryptographic key
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Características de los “Synchronous Token Devices”?

A
  • Rely upon synchronizing with authentication server.

- Authentication server knows what “password” to expect based on time or event.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

¿Cómo funciona un “Asynchronous Token Devices”?

A
  • User logs in
  • Authentication returns a challenge to the user
  • User types challenges string into token device and presses enter.
  • Token devices return a reply
  • Only that specific user’s token device could respond with the expected reply.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

¿Cuál es la característica principal de las Memory Cards?

A
  • Holds information, does not process

- A credit card or ATM card is a type of memory card.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

¿Cuál es la característica principal de las SMART CARD?

A
  • Chip
  • Often integrated with PKI
  • Includes a microprocessor.
  • New credit cards
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

¿Cuáles son algunos ataques conocidos a las SMART CARDS?

A
  • Fault generation
  • Micro probing
  • Side channel attacks, differential power analysis, electromagnetic analysis.
21
Q

¿Cuáles son los dos tipos en los que se clasifican los biométricos?

A

Estáticos

Dinámicos

22
Q

¿Qué es un biométrico estático?

A

should not significantly, change over time. Bound to a user’s physiological traits. Fingerprint, hand geometry, iris, retina, etc.

23
Q

¿Qué es un biométrico dinámico?

A

Based on behavioral traits. Voice, signaturem keyboard cadence.

24
Q

¿A qué se le conoce como Error tipo 1?

A

FALSE REJECTION, a legitimate user is banned form access.

25
Q

¿A qué se le conoce como error tipo 2?

A

FALSE ACCEPTANCE, an impostor is allowed access.

26
Q

The level at which the FRR and the FAR meet is called:

A

CER (Crossover Error Rate). The lower the number, the more accurate the system. Iris scans are the most accurate.

27
Q

What are the most known biometrics concerns?

A
  • User acceptance
  • Many users fell biometrics are intrusive
  • Cost/benefit analysis
  • No way to revoke biometrics
28
Q

Menciona ejemplos de tecnologías de single-sign on:

A
  • Kerberos
  • LDAP
  • Sesame
  • Krypto Knight
29
Q

¿Qué es kerberos?

A

A network authetication protocol designed from MITs project Athena. Kerberos tries to ensure authentication security in an insecure environment.

30
Q

¿Qué tipo de cifrado usa kerberos?

A

Uses symmetric encryption to verify identifications.

31
Q

¿Cuáles son los componentes de kerberos?

A
  • AS (Authentication server)
  • TGS (Ticket Granting Service)
  • KDC (Key Distribution Center) –> runs the TGS & AS
32
Q

¿Qué un ticket en Kerberos?

A

Means of distributing session key.

33
Q

Menciona brevemente como funciona kerberos:

A

Kerberos funciona como una “FERIA” donde se debe autenticar el usuario a la entrada para que le den un ticket (TGT) para poder accesar.
Una vez dentro debe de contar con tickets de servicio (TGS) dependiendo a donde quiere accesar.
Una vez dentro en el servicio las ACL’s definen si puede o no accesar al servicio.

34
Q

What’s a constrained user interfaces?

A

Restrict user access by not allowing them see certain data or have certain funcionality. Examples: views, restricted shells.

35
Q

What’s a context dependant access control?

A

System reviews a situation, then makes a decision on access. P. ej. no acceso a nóminas desde casa o después de las 18 horas.

36
Q

¿Cuáles con las tecnologías o métodos de control de acceso mas conocidos?

A
  • Rule Based Access Control
  • Constrained User interfaces
  • Content Dependant Access Control
  • Context Dependant Access Control
37
Q

What’s a Content Dependant Access Control?

A

Access is determined by the type of data. P. ej. email filters tha look for specific things like “confidential”, “SSN” images etc.

38
Q

¿A qué se refiere el término “Centralized Access Control Administration”?

A

A centralized place for configuring and managing access control. All the AAA protocols: Authentication, Authorization, Auditing.

39
Q

Menciona ejemplos de Centralized Access Control Administration:

A
  • RADIUS
  • TACACS
  • TACACS +
  • DIAMETER
40
Q

¿Qué es RADIUS?

A

RADIUS (Remote Authentication Dial-In User Services) is an authentication protocol that authenticates and authorizes users.

41
Q

¿Cómo funciona el servicio RADIUS?

A
    • Users usually dial in to an access server (RADIUS client) that communicates with the RADIUS server.
    • RADIUS server usually contains a database of users and credentials.
    • Communication between the RADIUS client and server is protected.
42
Q

¿Qué protocolo usa RADIUS?

A

UDP

43
Q

¿Qué protocolo usan TACACS, TACACS+, DIAMETER?

A

TCP

44
Q

¿Cuál es el modelo que usa RADIUS?

A

Supplicant (system trying to connect LAN) + Authenticator (access point, VPN Server) + Central Authenticator Server.

45
Q

¿Cuál es el estandar que usa RADIUS?

A

802.1x / EAPoL (EAP over LAN)

46
Q

¿Qué significas las siglas EAP?

A

Extensible Authenticator Protocol. Extends beyond passwords and supports many means of authentication.

47
Q

¿Qué significas las siglas CHAP?

A

Challenge Handshake Authentication Protocol, better but can only use passwords.

48
Q

¿Qué es Tempest?

A

Is a standard to develop countermeasures to protect against this: all devices give off electrical/ magnetic signals.

CISSP rvnsquad (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions