Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 1: Access Control > Flashcards

Chapter 1: Access Control Flashcards

0
Q

In Access Control, what is an object?

A

An object is a passive entity that provides information to active subjects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

In Access Control, what is a subject?

A

An active entity that accesses a passive object to receive information from or modify (with authorization) an object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the three labels used in discussing objects?

A

User, owner, and custodian.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a user in the context of a subject?

A

Any subject that accesses objects on a system to perform some action or accomplish a work task.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an owner in the context of a subject?

A

The person who has final organizational authority for classifying objects and protecting and storing data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a custodian in the context of a subject?

A

A custodian is a subject who has been assigned or delegated the day-to-day responsibility of properly storing and protecting objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the CIA triad?

A

The three categories of IT loss: confidentiality, integrity, and availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is confidentiality?

A

Assurance that only authorized subjects can gain access to objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is integrity?

A

Assurance that only authorized subjects can modify objects, and that unauthorized modifications are detected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is availability?

A

Authorized requests for objects must be granted in reasonable time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define permissions.

A

Permissions refer to access granted for an object and determine what you can do with it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a security policy?

A

A document that defines the security requirements for an organization. It identifies security assets and the extent to which security solutions should protect them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define rights.

A

Rights refer to the ability to take an action on an object, such as modify system time or restore backed up data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Define privileges.

A

The combination of rights and permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the three primary types of access controls?

A

Preventive, detective, and corrective.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

There are three primary types of access control and four others. What are the other four?

A

Deterrent, recovery, directive, and compensation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a preventive access control?

A

An access control deployed to stop or thwart unwanted or unauthorized activity from occurring.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a detective access control?

A

An access control that is deployed to discover or detect unwanted or unauthorized activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a corrective access control?

A

An access control that returns systems to normal after an unwanted or unauthorized activity has occurred.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a deterrent access control?

A

An access control that is deployed to discourage violation if security policies. For example, policies, security training, fences, guards, and cameras.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a recovery access control?

A

An access control that is deployed to repair or restore resources, functions, and capabilities after a violation of security policies. An extension of corrective access controls, but with more advanced or complex abilities. Example: backups/restored, fault tolerant drive systems, clustering, antivirus.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a directive access control?

A

An access control that is deployed to direct, confine, or control the actions of subjects to force it encourage compliance with security policies. Notifications, monitoring, supervision.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a compensation access control?

A

An access control that is deployed to provide options to other existing controls to aid in enforcement and support of security policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the implementation categories of access controls?

A

Administrative, logical/technical, and physical.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is an administrative access control?

A

Policies and procedures defined by an organization’s security policy and other regulations and requirements. Management controls. These focus on personnel and business practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is a logical/technical access control?

A

Hardware or software mechanisms used to manage access and provide protection for resources and systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are physical access controls?

A

Items you can physically touch that are deployed to prevent, monitor, or detect direct contact with systems or areas within a facility.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is Defense-in-depth?

A

A strategy in which multiple layers or levels of access controls are deployed to provide layered security. Should use all of administrative, logical/technical, and physical controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the types if security elements that support access control?

A

Identification, authentication, authorization, and accountability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Describe identification

A

When a subject professes an identity and accountability is initiated. User provides a username, for example.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Describe authentication.

A

The process of verifying or testing that a claimed identity is valid. Requires the subject to provide additional information.

31
Q

What are the authentication factor types?

A

Type 1: Something you know
Type 2: Something you have
Type 3: Something you are or do

32
Q

Describe authorization.

A

Authorization indicates which subjects are trusted to perform certain actions.

33
Q

Describe accountability.

A

The process of tracking subject activities within logs.

34
Q

What is the most common authentication technique?

A

Passwords.

35
Q

Why are passwords poor security mechanisms?

A

1) users choose easy to remember passwords that are therefore easy to guess or crack
2) randomly generated passwords are hard to remember, so are often written down.
3) passwords are easy to share, write down, and forget
4) passwords can be stolen in many ways
5) passwords are sometimes sent clear text or over weak channels
6) password databases are sometimes stored in publicly accessible locations
7) weak passwords can be brute forced

36
Q

What is a cognitive password?

A

A series of questions about facts or predefined responses that only the subject should know.

37
Q

What is a smart card?

A

A usually credit-card sized ID or badge with an integrated circuit chip embedded. Contains information about the authorized bearer and one or more PKI certificates. Tamper resistant. Inserted into a reader and often has a password or PIN.

38
Q

What is an access control token?

A

A password generating device users carry with them. Often used with an additional access code or PIN.

39
Q

What are the two most common types of access control tokens?

A

Synchronous and asynchronous.

40
Q

What is a synchronous dynamic password token?

A

A token that generates passwords at fixed intervals. Such as every 60 seconds. Requires clock synchronization. Also uses a PIN.

41
Q

What is asynchronous dynamic token?

A

Does not use a clock, instead it generates passwords based on some event, such as the user entering a PIN. Often challenge response where the server sends the PIN.

42
Q

What is a static token?

A

An access control token that doesn’t generate dynamic passwords. Swipe card or physical key, for example.

43
Q

Biometrics are what type of authentication factor?

A

Type 3: something you are

44
Q

List biometric authentication and identification techniques.

A

Fingerprints, face scans, retina scans, iris scans, palm scans, hand geometry, heart/pulse patterns, voice recognition patterns, signature dynamics, keystroke patterns.

45
Q

What is the most accurate form of biometric authentication?

A

Retina scan. Can differentiate between identical twins.

46
Q

What is the second most accurate form of biometric authentication?

A

Iris scan.

47
Q

What is the least acceptable form of biometric authentication? Why?

A

Retina scan. It can reveal medical information.

48
Q

What do palm scanners actually measure?

A

Vein patterns in the hand using near-infrared light.

49
Q

What is a type 1 error in biometric authentication?

A

When a valid subject is not authenticated.

Also called False Rejection Rate (FRR)

50
Q

What is a type 2 error in biometric authentication?

A

When an invalid subject us authenticated.

Also called False Acceptance Rate (FAR)

51
Q

What is the Crossover Error Rate, and what is it used for?

A

It’s the point where a biometric authenticator’s false accept and false reject rate are equal. It’s a quality measure of the authenticator’s.

52
Q

What is biometric enrollment or registration?

A

The process a user must go through to create an initial profile in the system.

53
Q

What is the maximum time generally accepted for biometric registration or enrollment.

A

Used to be 2 minutes. Now generally one.

54
Q

The time a biometric system requires to scan and identify a subject is called?

A

Throughput rate.

55
Q

What range of times do subjects typically accept for biometric throughput rate?

A

6 seconds or faster.

56
Q

What is the risk of using multifaceted authentication when both authenticator’s are of the sane type?

A

The same attack may be used to compromise both. For example, stealing two passwords may be no harder than stealing one.

57
Q

What are Discretionary Access Controls?

A

Allows the owner of the object to control and define subject access to the object. All objects have owners. AKA identity-based access control. Often uses ACLs.

58
Q

What are Nondiscretionary Access Controls?

A

Administrators control access, not object owners. Central control, easier to manage, less flexible.

59
Q

Is a Rule Based Access Control discretionary or Nondiscretionary?

A

Nondiscretionary

60
Q

Example of a Rule Based Access Control?

A

Firewall.

61
Q

A Lattice Bases Access Control is discretionary or Nondiscretionary?

A

Nondiscretionary

62
Q

How do Lattice Based Access Controls work?

A

They define upper and lower bounds of access for every relationship between a subject and object.

63
Q

Describe Mandatory Access Control.

A

Relies upon classification labels, each of which represents a security domain. For example, Secret, Top Secret, etc. subjects get clearances that define their access levels.

64
Q

In Mandatory Access Control, what is a security domain?

A

A set of subjects and objects that share a common security policy.

66
Q

What is a hierarchical environment?

A

One where classification levels are ordered from low to high, and access to objects at one level grants access to all objects at a lower level, but prohibits access to objects at a higher level.

67
Q

What is a compartmentalized environment?

A

There is no relationship between one security domain and another. Each domain is a separate compartment, and the subject must have a specific clearance for each.

68
Q

What is a hybrid environment?

A

One that contains both heirarchical and compartmentalized concepts, such that each heirarchical level can contain isolated subdivisions.

69
Q

What is Role Based Access Control (RBAC)

A

RBAC defines a subject’s ability to access an object based on the subject’s role, or assigned tasks. Often implemented using groups.

In strict RBAC, users have only permissions granted to a role, no privileges are granted to users directly.

70
Q

When is RBAC useful?

A

In an environment with frequent personnel changes, since permissions are tied to a role, not an identity.

71
Q

What is Centralized Access Control?

A

All authorization verification is performed by a single entity within a system.

72
Q

What is Decentralized Access Control?

A

Various entities located throughout a system perform authentication verification. Also called idstributed access control.

73
Q

What are AAA protocols?

A

Authentication, authorization, and accounting.

74
Q

What are AAA protocols for?

A

They’re often used with VPNs and other network access servers to prevent internal LAN authentication systems and other servers from being attacked remotely.

75
Q

What is excessive privilege?

A

The situation where users have more privileges than their assigned work tasks dictate.

76
Q

What is creeping privilege?

A

The situation where users accumulate privileges over time as job roles and tasks change, but those privileges are not removed when no longer needed.

CISSP (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions