Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Work > Chap 3 - Identity Access Mgmt > Flashcards

Chap 3 - Identity Access Mgmt Flashcards

1
Q

what is access control

A

means to ensure that access to assets is authorized and restricted based on business and security requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

what is a subject

A

any person, process, device or entity that wants to access and object (data)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what is an object

A

information assets or systems resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what is Identity lifecycle (IAM)

A
  1. new ID request
  2. ID provisioning - establishing access
  3. authentication (per attempt)
  4. authorization
  5. accounting (track during access/after)
  6. User behavior review
  7. disable and deprovision OR job/duty change review
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

who grant access to data

A

DATA OWNER, asset owner reviews the request and provides access approval or rejection to the data custodian that implements it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what is authentication

A

the verification of a claim of identity by a user, process, device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what is authorization

A

a. initial decision to grant access/ permission to an ID

b. real-time confirmation that a request to perform an action by a subject towards a given object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what is accounting/accountability

A

ID mgmt function that tracks every action involving every identity defined in the system

in form form of logs, these are store/analized using tech e.g., SIEM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what is user behavior review

A

organization should define sets or patterns of user behaviors that are acceptable and expected in most circumstance to detect extra-ordinary activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what is “privilege creep”

A

do not relinquish permissions that are not needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ID access disable and deprovision

A

deactivation of permissions throughout the systems.

Accounts are not deleted but disabled.

the data custodian or other IAM administrators perform these tasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

common issue identifiable when conducting account access review

A
  1. inactive accounts not revoked
  2. user accounts with excessive permissions
  3. user accounts without permissions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Security identifiers defaults accounts in Microsoft windows

A
  1. Administrator
  2. default account
  3. guest
  4. domain administrator
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

how to reduce risk of credential misuse

A

Multi-factor authentication (MFA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

types of privilege escalation attacks

A
  1. vertical privilege escalation
  2. horizontal privilege escalation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is IAAA

A

Identification
Authentication
Authorization
Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what is CIANA+PS

A

Confidentiality
Integrity
Availability
Non-repudiation
Accountability
Privacy
Safety

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Bell-LaPadula security model

A
  1. Subject cannot read/access object of higher classification
  2. subject can only save an object at same or higher classification (no write down)
  3. Subject can on write/edit at same classification level
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Biba security model

A
  1. subject cannot read/observe an object of lower integrity (no read down)
  2. subject cannot modify an object of higher integrity (no write up)
  3. subject can only request access to same or lower integrity level
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

which security model is known for preventing conflict or interest (Ethical Waals)

A

Brewer and Nash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

which security model improved Biba by addressing the integrity at the transaction level

A

Clark-Wilson

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Graham-Denning security model

A

Focus on HOW subject and objects are created

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

2 key modern security model - access control models (AC)

A
  1. Discretionary access control (DAC)
  2. Mandatory access control (MAC)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

types of access control models (AC)

A
  1. Discretionary access control (DAC)
  2. Mandatory access control (MAC)
  3. Non-discretionary access control (NDAC) -> most common (central authority making policies)
  4. Role-based access control (RBAC)
  5. Rule-based access control (RuBAC)
  6. Attribute-based access control (ABAC)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Common type of privileged accounts mgmt

A
  1. system admin
  2. Help desk or IT support
  3. security analyst
  4. others
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

type of IAM administration choices/implementation

A
  1. CENTRALIZED: one function is responsible for configurating the ACs
  2. DECENTRALIZED or DISTRIBUTED: ACs are controlled by owners or creators of the files
  3. HYBRID: Centralized control exercised for some information and decentralized control allowed for other information (less sensitive)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

what are logical access control systems

A

Logical access control systems as automated systems that
- authorize or deny use to user
- authorize or permit user
- identity registered and approved in system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

what is a credential management system

A

software that issue and manage credentials

CMS software can be used as part of public key infrastructure (PKI) systems, as well as issuing 2-factor-authentication (2FA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

what are the key identity credential access mgmt rules for building a sound credential architecture in Fed ageny

A
  1. sponsorship
  2. enrollment
  3. credential production
  4. issuance
  5. credential lifecycle mgmt
30
Q

authentication: what are the standard evidence for being allowed access -> 3 types of primary factors/evidence

A
  1. Something you know -> e.g., password
  2. Something you have -> e.g., token, smart card
  3. something you are/do -> e.g., biometric or fingerprint
31
Q

Single-Factor VS. Multi-Factor authentication

A
  1. Single: only 1x type of authentication evidence required (eg password)
  2. Multi: more than 1x factor to authenticate (eg. password & SMS token/RSA token)
32
Q

what are the two type of access control tokens

A
  1. Physical security token: address the “something you have” part of MFA challenge
  2. logical access token: data package generated by AC system for authentication of user that contain info about ID, privilege granted and other
33
Q

what is an identity assurance level (IAL)

A

refers to the identity proofing process –> convey the degree of confidence that the applicant claim ID is real

34
Q

what are the 3 identity insurance levels (IAL)

A

IAL1 - attributes are self-asserted
IAL2 - verified in person or remotely (min SP 800-63A)
IAL3 - in person ID proofing required (physical docs)

AAL - authenticator assurance level
FAL - Federation assurance level

35
Q

what is a single sign-on (SSO)

A

centralized repository of user credentials, such as user IDs and password, associated with a suite of application

36
Q

what are key SSO imitations, risks and challenges

A
  1. Legacy systems
  2. single point of failure
  3. password synchronization
37
Q

type of errors in access control

A

Type 1 or FRR -> False rejection rate

Type 2 or FAR -> False acceptance rate (most DANGEROUS)

the optimal point where they crossover is –> Crossover error rate (CER)

38
Q

what is Just-In-Time identity (JIT)

A

provides on-demand real-time creation and provisioning user ID, privileges escalation and de-escalation, -> full ID lifecycle (incl. deprovision and termination)

39
Q

what are some key use case of Just-In-Time identity (JIT)

A
  1. PAM -> privilege account mgmt
  2. privilege session mgmt
  3. endpoint privilege mgmt
  4. remote help desk
40
Q

what is Kerberos and essential goal

A

kerberos is based on symmetric encryption and a secret key shared among the participants (key are on the network)

primary goal of kerberos is to ensure private communications between systems over a network

41
Q

What is the Kerberos ticket exchange process

A
  1. user ping kerberos -> request for ticket
  2. kerberos provide authentication ticket (TGT)
  3. user send TGT to kerberos to get service ticket
  4. kerberos provide service ticket
  5. user share service ticket to server to authenticate
42
Q

issues with Kerberos

A
  1. single point of failure
  2. length of key
43
Q

what is security assertion markup language (SAML)

A

tip: same as telecommunication authentication

3 roles: IdP / SP/RP / user agent

44
Q

SAML 4 primary components

A
  1. assertion
  2. binding
  3. protocols –> SOAP and HTTP
  4. profiles
45
Q

what is Open Authorization (OAuth)

A

Tip: think about OKTA

enables 3rd party application to obtain limited access to an HTTP service on behalf of a resource

46
Q

what are the 4 roles of OAuth standard

A
  1. resource owner
  2. resource server
  3. client application
  4. authorization server
47
Q

The Acme Widgets Company is putting new controls in place for its accounting department. Management is concerned that a rogue accountant may be able to create a new false vendor and then issue checks to that vendor as payment for services that were never rendered. What security control can best help prevent this situation?

A

Separation of duties

48
Q

An accounting employee at Doolitte Industries was recently arrested for participation in an embezzlement scheme. The employee transferred money to a personal account and then shifted funds around between other accounts every day to disguise the fraud for months. Which one of the following controls might have best allowed the earlier detection of this fraud?

A

Mandatory vacation

49
Q

Sally is blocked from reading the file due to the Biba integrity model. Sally has a Secret security clearance and the file has a Confidential classification. What principle of the Biba model is being enforced?

A

Simple Integrity Property

The Simple Integrity Property states that an individual may not read a file classified at a lower security level than the individual’s security clearance

50
Q

Harry’s request to write to the data file is blocked. Harry has a Secret security clearance and the data file has a Confidential classification. What principle of the Bell-LaPadula model blocked this request?

A

*-Security Property

The *-Security Property states that an individual may not write to a file at a lower classification level than that of the individual. This is also known as the confinement property.

51
Q

Sally is blocked from writing to the data file by the Biba integrity model. Sally has a Secret security clearance and the file is classified Top Secret. What principle is preventing her from writing to the file?

A

*-Integrity Property

The *-Integrity Property states that a subject cannot modify an object at a higher security level than that possessed by the subject

52
Q

The Bell-LaPadula and Biba models implement state machines in a fashion that uses what specific state machine model?

A

Information flow

53
Q

what type of threats does the Biba model of access control address

A

It focuses on protecting objects from external threats.

54
Q

Which of the following is best described as an access control model that focuses on subjects and identifies the objects that each subject can access?

A

A. An access control list
B. An implicit denial list
C. A capability table –> correct answer
D. A rights management matrix

55
Q

Jim’s organization-wide implementation of IDaaS offers broad support for cloudbased applications. The existing infrastructure for Jim’s company does not use centralized identity services but uses Active Directory for AAA services. Which of the following choices is the best option to recommend to handle the company’s onsite identity needs?

A

Use an on-premise third-party identity service.

56
Q

what are the type of authentication factor?

A

Type 1 factors are “something you know,”

Type 2 factors are “something you have.”

type 3 factors are “something you are,”

57
Q

What type of attack can be prevented by using a trusted path?

A

Login spoofing

58
Q

Callback to a home phone number is an example of what type of factor?

A

Somewhere you are

59
Q

Which of the following AAA protocols is the most commonly used?

A

TACACS+

60
Q

what protocol use single sign-on implementation?

A

Kerberos,

Active Directory Federation Services (ADFS),

Central Authentication Services (CAS)

61
Q

What type of access controls allow the owner of a file to grant other users access to it using an access control list?

A

Discretionary

Note: Non-discretionary access controls apply a fixed set of rules to an environment to manage access

62
Q

Jacob is planning his organization’s biometric authentication system and is considering retina scans. What concern may be raised about retina scans by others in his organization?

A

Retina scans can reveal information about medical conditions.

HIPPA compliance

63
Q

Mandatory access control is based on what type of model?

A

Lattice based

64
Q

what is RADIUS

A

an authentication protocol commonly used for backend services

65
Q

what is TACACS+

A

Is an AAA protocol
only TACAC protocol used today

66
Q

what is implicit denial

A

all action that is not explicitly authorized for a subject should be denied

67
Q

what is Access Control List (ACLs)

A

listing of subjects and their permissions on objects and group of objects

68
Q

what is Discretionary Access Control (DAC)

A

systems allow the owners of objects to modify the permissions that other users have on those objects

69
Q

what is a Mandatory Access Control (MAC)

A

systems enforce predefined policies that users may not modify

70
Q

what is role-based access control

A

assign permissions to individuals users based on their role in the organization

71
Q

what is a rainbow table attack

A

precompute hash values for use in comparison

Work (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions