chapter 2

Question 1

Basic Security Requirement

Derived Security Requirement

Answer 1

identify information system users, processes acting on behalf of users, or devices.
2 Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite
to allow access to organizational information systems.

• use multifactor authentication
• Enforced a minimum password complexity and change of characters when new passwords are created.

Question 2

NIST authentication architectural model

Answer 2

1 Registration authority
2 relying party
3 credential service provider
4 relying party

Question 3

Four means of authenticating user identity

Answer 3

Something the individual knows
something the individual possesses
something the individual is
something the individual does

Question 4

Risk Assessment for User authentication

Answer 4

Assurance level = should increase as risk increases

Potential impact
Areas of risk = include the ability to operate, asset damage, financial loss, harm to individuals

Question 5

SP 800-63-3
SP 800-63A
SP 800-63B
SP 800-63C

Answer 5

Digital identity guidelines
Enrollment and identity proofing
authentication and lifecycle management
Federation and Assertions

Question 6

Identity Assurance Level
IAL1
IAL2
IAL3

Answer 6

Self-asserted

either remote or in-person

In-person identity proofing is required

Question 7

Authentication Assurance Level
AAL1
AAL2
AAL3

Answer 7

AAL1 uses single-factor authentication.

Proof of possession and control of two-factor authentication

Proof of possession of a key through a cryptographic protocol

Question 8

Password-Based Authentication is used in access control systems

Question 9

Guess-Verify attacks

Keyloggers
Phishing
Social Engineering

Answer 9

1st = use some leaked information about passwords

Directly obtain the password

Question 10

Guess verify Attack

• Online guessing
• Offiline guessing

Answer 10

Send a guess and receive the response in real-time

Obtain a password file/table, try guesses against the file

Question 11

Lateral Movement

Privilege escalation

Answer 11

attack “weakest” door, and then move laterally to
target

get access to any “weak” account, then exploit
bug/design flaw/configuration oversight to gain elevated access to
resources that are normally protected from app/user