Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CYSA+ > Chapter 11 Identity and Access Management Security > Flashcards

Chapter 11 Identity and Access Management Security Flashcards

1
Q

Associated with an identity include information about a subject and often include their name, address, title, contact information, and other details about the individual

A

Attributes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Create, store, and manage identity information as well as the permissions, groups, and other information needed to support the use of identities

A

IAM systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q
  • Provide information about systems, users, and other information about the organization
  • i.e. LDAP
A

Directory services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What steps are required to implement a secure LDAP server?

A
  • Enabling and requiring TLS keeps LDAP queries and authentication secure
  • Setting password storage to use a secure method. LDAP passwords are often stored in plain text, additional methods are supported and should be used if possible
  • Use password-based authentication in requiring TLS
    Replication of LDAP servers can help prevent denial-of-service attacks another service outages
  • Access Control list for LDAP offer the ability to limit access to specific objects in the directory as well as for how entries are created, modified, and deleted
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Uses TCP traffic to provide AAA services

A

TACACS+

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q
  • Can operate via TCP or UDP and operates in a client-server model
  • Sends passwords that are obfuscated by a shared secret or md5 hash password security is not very strong
A

RADIUS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Designed to operate on untrusted networks and uses encryption to protect its authentication traffic

A

Kerberos

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Users in Kerberos are known as what?

A

Principles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Users in Kerberos called principles are composed of what three elements?

A

The primary - Frequently the username
The instance - Used to differentiate similar primaries
The realm - Consist of groups and principles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q
  • Systems to allow users to authenticate once and then to use multiple systems are services without having to use different usernames or passwords
  • i.e. LDAP and the central authentication Service (CAS)
A

Single Sign-On

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Allow and identity to be reused on multiple sites while relying on authentication via single identity provider

A

Shared Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Shared Authentication Technologies include what?

A

OpenID
OAuth
OpenID Connect
Facebook Connect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q
  • An open-source standard for decentralized authentication

- Users create credentials with an identity provider like Google then sites (relying parties) use that identity

A

OpenID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q
  • Relies on access tokens which are issued by an authorization server and then presented to resource servers like third-party web applications
  • Used by Google, Microsoft, Facebook and other sites to allow users to share elements of their identity or account information while authenticating via the original identity provider
A

OAuth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Authentication layer built using the OAuth protocol

A

OpenID Connect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Shared authentication system that relies on Facebook credentials for authentication

A

Facebook Connect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Includes training and awareness, as well as threats like Insider attacks, phishing and social engineering

A

Personal based identity security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Their roles in attacks on identity, including capturing credentials via local exploits; screen capture and keyboard capture applications

A

Endpoint Threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Can target systems that run identity services, or which can attack the servers and send identity and authentication data to AAA services

A

Server-based exploits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Provide, consume and interact with identity services

A

Applications and services

21
Q

Are associated with users or groups

A

Rules, Rights, and Permissions

22
Q

Attacks against LDAP directory servers typically focus on what?

A
  • Attacks against insecure binding (Connection)
  • Improper LDAP access controls
  • LDAP injection
  • Denial-of-service attacks
23
Q
  • Method that target unencrypted LDAP traffic either to capture the traffic or to exploit LDAP as an authentication service
  • LDAP Attack
A

Attacks against insecure binding (Connection)

24
Q

Allows attackers to harvest directory information or to make modifications to directory entries that they should not be able to change
- LDAP Attack

A

Improper LDAP access controls

25
Q

Exploit web applications that build LDAP query using user input, allowing attackers to gather additional information or to make changes they should not be authorized to make by operating as the web service
- LDAP Attack

A

LDAP injection

26
Q

Most common attacks for OAuth and OpenID

A

Open redirects these result in users being redirected to untrusted sites, allowing phishing scams or permitting attackers to bypass security layers

27
Q

Common Kerberos attacks include what?

A

Administrator account attacks
Kerberos ticket reuse - Includes pass the ticket attacks which allows impersonation of legitimate users for the lifespan of the ticket
Ticket granting ticket (TGT) focused attacks - Allows complete access to the Kerberos connected systems, including creation of new tickets, account changes, and even the falsification of accounts or services

28
Q

RADIUS attacks often focus on what?

A

Session replay
Targeting RADIUS shared secret
Denial-of-service attacks
Credential based attacks

29
Q

Common active directory attacks include what?

A

Malware focused attacks - Place credential capturing or exploit based malware onto AD servers
Credential theft
Privilege escalation attacks
Service accounts
Domain administrator
The use of down level versions of protocols ie NTLM v1 and LANMAN, NetBIOS, and unsigned LDAP and SMB to capture credentials or to conduct other attacks

30
Q

States that users should be provided only with the least set of privileges or permissions required to perform their job function

A

Least privilege

31
Q

A steady accrual of additional rights over time as account owners change roles

A

Privilege creep

32
Q

Occurs when an attacker takes the identity of a legitimate user

A

Impersonation attacks

33
Q

Focuses on taking over an already existing session, either by acquiring the session key or cookies used

A

Session hijacking

34
Q

Focuses on exploiting flaws to gain elevated permissions or access

A

Privilege escalation attacks

35
Q

Combines multiple malicious software tools to provide continued access to a computer while hiding your own existence

A

Rootkits

36
Q

Context-based authentication includes what?

A
  • User roles and group membership related to application or service access
  • IP address and or IP reputation, providing information on whether and remote IP is known to be a part of a botnet
  • Time of day, often related to job role or working hours
  • Location-based information like their GPS location
  • Frequency of access
  • Device based including information about the web browser and youth and other data that can provide device fingerprint
37
Q

Authentication decisions to be made based on information about the user, the systems the user is connecting from, or other information that is relevant to the system or organization performing the authentication.

A

Context-based authentication

38
Q

Service provides authentication services, typically as a cloud hosting service

A

Identity as a Service (IDaaS)

39
Q

Configuring a SIEM or other security monitoring device to look for the following types of events can provide what significant security benefits?

A
  • Privileged account usage
  • Privilege changes and grants
  • Account creation and modification
  • Employee termination and terminated account usage
  • Account lifecycle management events
  • Separation-of-duty violations
40
Q

Move trust boundaries outside of your own organization, resulting in new concerns when designing and implementing

A

Federated identities

41
Q

Members of a federation must provide identities, make assertion about those identities to relying parties, and release information to relying parties about identity holders

A

Identity provider

42
Q

What four major technologies serve as the core of Federated identity or current federations?

A
  1. SAML
  2. Active Directory Federation Services (ADFS)
  3. OAuth
  4. OpenID Connect
43
Q
  • XML-based language used to send authentication and authorization data between identity providers and service providers
  • Frequently used to enable single sign-on for web applications and services
A

SAML

44
Q
  • Provides authentication and identity information that’s claims to third-party partner sites.
  • Partner sites didn’t use trust policies to match claims to claim supported by the service and then uses those claims to make authorization decisions
A

Active Directory Federation Services (ADFS)

45
Q

Provides an authorization framework designed to allow third-party applications to access HTTP based services

A

OAuth

46
Q
  • Allows the authorization server to issue an ID token in addition to the authorization token provided by OAuth
  • Often paired with OAuth to provide Authentication
A

OpenID Connect

47
Q

Active Directory Federation Services (ADFS) process is what?

A
  1. The user attempts to access the ADFS enabled web application hosted by resource partner
  2. The ADFS web agent on the partners web server checks for a ADFS cookie if it’s their access is granted
  3. The Resource Partners ADFS checks for a SAML token from the account partner, if it’s not found, ADFS performs home realm discovery
  4. Home realm discovery identifies the Federation server associated with the user and then authenticates the user via the home realm
  5. The account partner then provides a security token with identity information in the form of claims, and sends that user back to the resource partner adfs server
  6. Validation then occurs normally and uses its trust policy to map the account partner claims to claims the web application support
  7. A new SAML token is created by a ADFS that contains the resource partner claims and it’s cookie is stored on the user’s computer
48
Q

OAuth flows recognize what four parties?

A

Clients - applications that users want to use
Resource owners - the end users
Resource servers - Servers provided by a service that the resource owner wants the application to use
Authorization servers - servers owned by the identity provider

49
Q

Response plan for Federated identity varies based on the role you organization holds in Federation list them

A
  • Identity providers are typically responsible for notifying account owners and may be responsible for notifying with relying parties
  • Service providers need to determine what their response would be if the identity provider were compromised as well as a range of smaller incidents

CYSA+ (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions