Chap 3 - Identity Access Mgmt Flashcards
1
Q
what is access control
A
means to ensure that access to assets is authorized and restricted based on business and security requirements
2
Q
what is a subject
A
any person, process, device or entity that wants to access and object (data)
3
Q
what is an object
A
information assets or systems resources
4
Q
what is Identity lifecycle (IAM)
A
- new ID request
- ID provisioning - establishing access
- authentication (per attempt)
- authorization
- accounting (track during access/after)
- User behavior review
- disable and deprovision OR job/duty change review
5
Q
who grant access to data
A
DATA OWNER, asset owner reviews the request and provides access approval or rejection to the data custodian that implements it
6
Q
what is authentication
A
the verification of a claim of identity by a user, process, device
7
Q
what is authorization
A
a. initial decision to grant access/ permission to an ID
b. real-time confirmation that a request to perform an action by a subject towards a given object
8
Q
what is accounting/accountability
A
ID mgmt function that tracks every action involving every identity defined in the system
in form form of logs, these are store/analized using tech e.g., SIEM
9
Q
what is user behavior review
A
organization should define sets or patterns of user behaviors that are acceptable and expected in most circumstance to detect extra-ordinary activities
10
Q
what is “privilege creep”
A
do not relinquish permissions that are not needed
11
Q
ID access disable and deprovision
A
deactivation of permissions throughout the systems.
Accounts are not deleted but disabled.
the data custodian or other IAM administrators perform these tasks
12
Q
common issue identifiable when conducting account access review
A
- inactive accounts not revoked
- user accounts with excessive permissions
- user accounts without permissions
13
Q
Security identifiers defaults accounts in Microsoft windows
A
- Administrator
- default account
- guest
- domain administrator
14
Q
how to reduce risk of credential misuse
A
Multi-factor authentication (MFA)
15
Q
types of privilege escalation attacks
A
- vertical privilege escalation
- horizontal privilege escalation
16
Q
what is IAAA
A
Identification
Authentication
Authorization
Accountability
17
Q
what is CIANA+PS
A
Confidentiality
Integrity
Availability
Non-repudiation
Accountability
Privacy
Safety
18
Q
Bell-LaPadula security model
A
- Subject cannot read/access object of higher classification
- subject can only save an object at same or higher classification (no write down)
- Subject can on write/edit at same classification level
19
Q
Biba security model
A
- subject cannot read/observe an object of lower integrity (no read down)
- subject cannot modify an object of higher integrity (no write up)
- subject can only request access to same or lower integrity level
20
Q
which security model is known for preventing conflict or interest (Ethical Waals)
A
Brewer and Nash
21
Q
which security model improved Biba by addressing the integrity at the transaction level
A
Clark-Wilson
22
Q
Graham-Denning security model
A
Focus on HOW subject and objects are created
23
Q
2 key modern security model - access control models (AC)
A
- Discretionary access control (DAC)
- Mandatory access control (MAC)
24
Q
types of access control models (AC)
A
- Discretionary access control (DAC)
- Mandatory access control (MAC)
- Non-discretionary access control (NDAC) -> most common (central authority making policies)
- Role-based access control (RBAC)
- Rule-based access control (RuBAC)
- Attribute-based access control (ABAC)
25
Common type of privileged accounts mgmt
1. system admin
2. Help desk or IT support
3. security analyst
4. others
26
type of IAM administration choices/implementation
1. CENTRALIZED: one function is responsible for configurating the ACs
2. DECENTRALIZED or DISTRIBUTED: ACs are controlled by owners or creators of the files
3. HYBRID: Centralized control exercised for some information and decentralized control allowed for other information (less sensitive)
27
what are logical access control systems
Logical access control systems as automated systems that
- authorize or deny use to user
- authorize or permit user
- identity registered and approved in system
28
what is a credential management system
software that issue and manage credentials
CMS software can be used as part of public key infrastructure (PKI) systems, as well as issuing 2-factor-authentication (2FA)
29
what are the key identity credential access mgmt rules for building a sound credential architecture in Fed ageny
1. sponsorship
2. enrollment
3. credential production
4. issuance
5. credential lifecycle mgmt
30
authentication: what are the standard evidence for being allowed access -> 3 types of primary factors/evidence
1. Something you know -> e.g., password
2. Something you have -> e.g., token, smart card
3. something you are/do -> e.g., biometric or fingerprint
31
Single-Factor VS. Multi-Factor authentication
1. Single: only 1x type of authentication evidence required (eg password)
2. Multi: more than 1x factor to authenticate (eg. password & SMS token/RSA token)
32
what are the two type of access control tokens
1. Physical security token: address the "something you have" part of MFA challenge
2. logical access token: data package generated by AC system for authentication of user that contain info about ID, privilege granted and other
33
what is an identity assurance level (IAL)
refers to the identity proofing process --> convey the degree of confidence that the applicant claim ID is real
34
what are the 3 identity insurance levels (IAL)
IAL1 - attributes are self-asserted
IAL2 - verified in person or remotely (min SP 800-63A)
IAL3 - in person ID proofing required (physical docs)
AAL - authenticator assurance level
FAL - Federation assurance level
35
what is a single sign-on (SSO)
centralized repository of user credentials, such as user IDs and password, associated with a suite of application
36
what are key SSO imitations, risks and challenges
1. Legacy systems
2. single point of failure
3. password synchronization
37
type of errors in access control
Type 1 or FRR -> False rejection rate
Type 2 or FAR -> False acceptance rate (most DANGEROUS)
the optimal point where they crossover is --> Crossover error rate (CER)
38
what is Just-In-Time identity (JIT)
provides on-demand real-time creation and provisioning user ID, privileges escalation and de-escalation, -> full ID lifecycle (incl. deprovision and termination)
39
what are some key use case of Just-In-Time identity (JIT)
1. PAM -> privilege account mgmt
2. privilege session mgmt
3. endpoint privilege mgmt
4. remote help desk
40
what is Kerberos and essential goal
kerberos is based on symmetric encryption and a secret key shared among the participants (key are on the network)
primary goal of kerberos is to ensure private communications between systems over a network
41
What is the Kerberos ticket exchange process
1. user ping kerberos -> request for ticket
2. kerberos provide authentication ticket (TGT)
3. user send TGT to kerberos to get service ticket
4. kerberos provide service ticket
5. user share service ticket to server to authenticate
42
issues with Kerberos
1. single point of failure
2. length of key
43
what is security assertion markup language (SAML)
tip: same as telecommunication authentication
3 roles: IdP / SP/RP / user agent
44
SAML 4 primary components
1. assertion
2. binding
3. protocols --> SOAP and HTTP
4. profiles
45
what is Open Authorization (OAuth)
Tip: think about OKTA
enables 3rd party application to obtain limited access to an HTTP service on behalf of a resource
46
what are the 4 roles of OAuth standard
1. resource owner
2. resource server
3. client application
4. authorization server
47
The Acme Widgets Company is putting new controls in place for its accounting department. Management is concerned that a rogue accountant may be able to create a new false vendor and then issue checks to that vendor as payment for services that were never rendered. What security control can best help prevent this situation?
Separation of duties
48
An accounting employee at Doolitte Industries was recently arrested for participation in an embezzlement scheme. The employee transferred money to a personal account and then shifted funds around between other accounts every day to disguise the fraud for months. Which one of the following controls might have best allowed the earlier detection of this fraud?
Mandatory vacation
49
Sally is blocked from reading the file due to the Biba integrity model. Sally has a Secret security clearance and the file has a Confidential classification. What principle of the Biba model is being enforced?
Simple Integrity Property
The Simple Integrity Property states that an individual may not read a file classified at a lower security level than the individual’s security clearance
50
Harry’s request to write to the data file is blocked. Harry has a Secret security clearance and the data file has a Confidential classification. What principle of the Bell-LaPadula model blocked this request?
*-Security Property
The *-Security Property states that an individual may not write to a file at a lower classification level than that of the individual. This is also known as the confinement property.
51
Sally is blocked from writing to the data file by the Biba integrity model. Sally has a Secret security clearance and the file is classified Top Secret. What principle is preventing her from writing to the file?
*-Integrity Property
The *-Integrity Property states that a subject cannot modify an object at a higher security level than that possessed by the subject
52
The Bell-LaPadula and Biba models implement state machines in a fashion that uses what specific state machine model?
Information flow
53
what type of threats does the Biba model of access control address
It focuses on protecting objects from external threats.
54
Which of the following is best described as an access control model that focuses on subjects and identifies the objects that each subject can access?
A. An access control list
B. An implicit denial list
C. A capability table --> correct answer
D. A rights management matrix
55
Jim’s organization-wide implementation of IDaaS offers broad support for cloudbased applications. The existing infrastructure for Jim’s company does not use centralized identity services but uses Active Directory for AAA services. Which of the following choices is the best option to recommend to handle the company’s onsite identity needs?
Use an on-premise third-party identity service.
56
what are the type of authentication factor?
Type 1 factors are “something you know,”
Type 2 factors are “something you have.”
type 3 factors are “something you are,”
57
What type of attack can be prevented by using a trusted path?
Login spoofing
58
Callback to a home phone number is an example of what type of factor?
Somewhere you are
59
Which of the following AAA protocols is the most commonly used?
TACACS+
60
what protocol use single sign-on implementation?
Kerberos,
Active Directory Federation Services (ADFS),
Central Authentication Services (CAS)
61
What type of access controls allow the owner of a file to grant other users access to it using an access control list?
Discretionary
Note: Non-discretionary access controls apply a fixed set of rules to an environment to manage access
62
Jacob is planning his organization’s biometric authentication system and is considering retina scans. What concern may be raised about retina scans by others in his organization?
Retina scans can reveal information about medical conditions.
HIPPA compliance
63
Mandatory access control is based on what type of model?
Lattice based
64
what is RADIUS
an authentication protocol commonly used for backend services
65
what is TACACS+
Is an AAA protocol
only TACAC protocol used today
66
what is implicit denial
all action that is not explicitly authorized for a subject should be denied
67
what is Access Control List (ACLs)
listing of subjects and their permissions on objects and group of objects
68
what is Discretionary Access Control (DAC)
systems allow the owners of objects to modify the permissions that other users have on those objects
69
what is a Mandatory Access Control (MAC)
systems enforce predefined policies that users may not modify
70
what is role-based access control
assign permissions to individuals users based on their role in the organization
71
what is a rainbow table attack
precompute hash values for use in comparison
