CF Domain 5 Flash Cards

Question 1

Access Control System

Answer 1

Means to ensure that access to assets is authorized and restricted based on business and security requirements related to logical

Question 2

Access control tokens

Answer 2

The system decides if access is to be granted or denied based upon the validity of the token for the point where it is read based on time, date, day, holiday, or other condition used for controlling validation.

Question 3

Accountability

Answer 3

ensures that account management has assurance that only authorized users are accessing the system and using it properly

Question 4

Attribute based access
control (ABAC)

Answer 4

This is an access control paradigm whereby access rights are granted to users with policies that combine attributes together

Question 5

Authorization

Answer 5

The process of defining the specific resources a user needs and determining the type of access to those resources the user may have.

Question 6

Active Directory Federation Services (ADFS)

Answer 6

identity access solution that provides client computers (internal or external to your network) with seamless SSO access to protected Internet-facing applications or services, even when the user accounts and applications are located in completely different networks or orgs

Question 7

Crossover Error Rate
(CER)

Answer 7

point at which false acceptance (Type 2) error rate equals the false rejection (Type 1) error rate for a given sensor, in a given system and context; it is the optimal point of operation if the potential impacts of both types of errors are equivalent

Question 8

Capability tables

Answer 8

list privileges assigned to subjects and identify the objects that subjects can access

Question 9

Central Authentication Service (CAS)

Answer 9

an SSO implementation

Question 10

Content-dependent control

Answer 10

Content-dependent access control adds additional criteria beyond identification and authentication: the actual content the subject is attempting to access; all employees of an org may have access to the HR database to view their accrued sick time and vacation time, but should an employee attempt to access the content of the CIO’s HR record, access is denied

Question 11

Context-dependent access control

Answer 11

applies additional context before granting access, with time as a commonly used context

Question 12

Cross-Site Request Forgery (CSRF)

Answer 12

(AKA XSRF) an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated

Question 13

Discretionary access control
(DAC)

Answer 13

The system owner decides who gets access

Question 14

False Acceptance Rate (Type
II FAR)

Answer 14

the percentage of identification instances in which unauthorized persons are incorrectly accepted.

Question 15

False Rejection Rate (Type I FRR)

Answer 15

the percentage of identification instances in which authorized persons are incorrectly rejected

Question 16

Ethical Wall

Answer 16

the use of administrative, physical/logical controls to establish/enforce separation of information, assets or job functions for need-to-know boundaries or prevent conflict of interest situations; AKA compartmentalization

Question 17

Granularity of controls

Answer 17

level of abstraction or detail which in a security function can be configured or tuned for performance and sensitivity

Question 18

Identity as a Service
(IDaaS)

Answer 18

Cloud-based services that broker identity and access management functions to target systems on customers’ premises and/or in the cloud.

Question 19

Identity proofing

Answer 19

The process of collecting and verifying information about a person for the purpose of proving that a person who has requested an account, a credential, or other special privilege.

Question 20

Logical access control system

Answer 20

Non-physical system that allows access based upon pre-determined policies.

Question 21

Mandatory Access Controls
(MAC)

Answer 21

Access control that requires the system itself to manage access controls in accordance with the organization’s security policies.

Question 22

Multi factor authentication

Answer 22

Ensures that a user is who they claim to be. The more factors used to determine a person’s identity, the greater the trust of authenticity.

Question 23

Open Authorization
(OAuth)

Answer 23

The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.

Question 24

Physical access control
system

Answer 24

An automated system that manages the passage of people or assets through an opening(s) in a secure perimeter(s) based on a set of authorization rules

Question 25

Rule based access control
(RBAC)

Answer 25

An access control model that is based on a list of predefined rules that determine what accesses should be granted.

Question 26

Role based access control
(RBAC)

Answer 26

An access control model that bases the access control authorizations on the roles (or functions) that the user is assigned within an organization.

Question 27

Security Assertion Markup
Language 2 .0 (SAML 2.0)

Answer 27

A version of the SAML OASIS standard for exchanging authentication and authorization data between security domains.

Question 28

Single factor
authentication

Answer 28

Involves the use of simply one of the three available factors solely in order to carry out the authentication process being requested.

Question 29

Self-service identity management

Answer 29

elements of the identity management lifecycle which the end-user (identity in question) can initiate or perform on their own (e.g. password reset, changes to challenge questions etc)

Question 30

Whaling attack

Answer 30

phishing attack targeting highly-placed officials/private individuals with sizeable assets authorizing large-fund wire transfers

Question 31

Cross-Site Scripting (XSS)

Answer 31

essentially uses reflected input to trick a user’s browser into executing untrusted code from a trusted site; these attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites; XSS attacks occur when an attacker uses a web app to send malicious code, generally in the form of a browser side script, to a different end user; flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it

Question 32

Cross-Site Tracing (XST)

Answer 32

attack involves the use of Cross-site Scripting (XSS) and the TRACE or TRACK HTTP methods; this could potentially allow the attacker to steal a user’s cookies