Authentication & Authorization Flashcards
RADIUS
Used for AUTHENTICATION & AUTHORIZATION purposes. Does NOT provide further access control. Uses UDP.
RADIUS Federation
Allows authentication to be SHARED without having to re-authenticate.
TACACS+
More reliable than RADIUS and uses TCP.
PAP
Username and password are sent in plaintext. NO PROTECTION. BAD.
CHAP
Better than PAP. Uses a one-way hashing function.
MSCHAP
Microsoft CHAP.
PAP, CHAP, and MSCHAP are old unsecure protocols.
Instead use MSCHAP with PEAP or L2TP/IPsec.
802.1X (not to be confused with 802.11)
Provides standards for port-based access control. Facilitates the use of EAP, RADIUS, digital certificates, etc.
SAML
An XML framework used for single sign-on AUTHENTICATION.
OAuth
Provides API authorization between applications.
IMPORTANT: Doesn’t provide authentication, only authorization.
OpenID Connect
Used for consumer single sign-on for AUTHENTICATION.
Shibboleth
SAML-based federated identity solution that provides SSO capabilities. Just another SSO option.
Kerberos
Symmetric key authentication protocol. Uses TICKETS. If you see questions with tickets or ticket granting tickets, it’s talking about Kerberos.
Mandatory access control (MAC)
Often used in the government. Think SENSITIVE, SECRET, and PUBLIC, or Classified, Secret, and Top Secret.
Discretionary access control (DAC)
Allows individual resources to be made available or secured. Think of your privacy settings on YOUR social media accounts. You control what people see, at your DISCRETION.
Role-based access control (RBAC)
Access rights are assigned to roles. Example: A server at a restaurant doesn’t need access to security cameras, but security guards would have that access.
Rule-based access control (also known as RBAC 🙃)
Controls are based on certain criteria like time of day, GPS, etc. Example: Users should only be logging in from the United States. That’s a rule.
Attribute-based access control (ABAC)
Access control based on characteristics/attributes. Examples: I’m allowing access to this file if you’re a cashier. I’m allowing you to DELETE something. (Actions can be attributes). ABAC is complicated.
Privileged access management (PAM)
Just think “least privilege”. PAM limits access to only those with the privilege to see/do something. Helps avoid elevated privilege incidents.
