Chapter 2: Authentication and Authorization Flashcards
Understand the Security Concepts of Information Assurance
What are the three steps to access control?
- Identification
- Authentication
- Authorization
Access Control Process
During the first step of the process, {BLANK}, an individual makes a claim about their identity.
Identification
Together, the activities performed ny an access control system are referred to as AAA, or “triple-A”.
What does the three A’s stand for?
Authentication, authorization, and accounting
Access Control Process
During the {BLANK} step, the individual proves thair identity to the satisfaction of the access control system.
Authentication
Access Control Process
The access control system also needs to be satisifed that you are allowed to access the system. This is the third step of the process called {BLANK}.
Authorization
Access Control Process
In addition to indentication, authentication, and authorization, access control systems also provide an {BLANK} functioanlity that allows administrators to track user activity and reconstruct it from logs.
Accounting
In the electronic world, authorization often takes the form of {BLANK} that itemize the specific file system permissions granted to an individual user or a group of users.
Access Control Lists
The simplest and most common control on passwords is setting the {BLANK}.
password length
Organizations may also set {BLANK} requirements. These requirements force users to include different types of characters in their passwords, such as uppercase and lowercase, digits, and special characters.
password complexity
{BLANK} requiremts force users to change their passwors periodically.
password expiration
{BLANK} requirements are designed to prevent users from reusing old passwords.
password history
What are the three authentication factors?
- Something you know
- Something you are
- Something you have
Authentication Factors
What is considersomething you know?
Passwords, Personal Identification Numbers (PINs), and answers to security questions.
Authentication Factors
What is considersomething you are?
Fingerprint, eye pattern, face, or voice.
{BLANK} authentication techniques measure one of your physical characteristics.
Biometric
Authentication Factors
What is considersomething you have?
Requires the user to have physical possession of a device.
- Smartphone running a software token application
- Hardware authentication token key fob
- Smart cards
The access control process consists of three major steps. {BLANK} is when a user makes claim of identity. {BLANK} is when the user proves that identity claim. {BLANK} is when the system determines whether the user is allowed tp perform a requested action.
Identification; Authentication; Authorization
{BLANK} processes create a record of who performed which actions on a system and are useful when investigating security incidents.
Accounting
{BLANK} combines at least two of the thre factors: something you know, something you have, and something you are.
Multi-factor Authentication (MFA)
Password {BLANK} requirements set a minimum number of characters that must be in a user’s password, whereas password {BLANK} requirements mandate the use of different character types.
length; complexity
Password {BLANK} requirement prevent the reuse of old passwords, whereas password {BLANK} requirements force the periodic reset of existing passwords. Users should be permitted to reset their passwords whebevr they wish.
history; expiration
Users should be encouraged not to {BLANK} passwords across multiple sites, as this increases the risk of compromise. Password {BLANK} provides a convenient tool for managing many unique, strong passwords.
reuse; managers
You are considering deploying a multi-factor authentication system to protect access to your organization’s virtual private network (VPN). Which one of the following combinations of access controls would meet this requirement?
A. Password and PIN
B. Fingerprint and eye scan
C. Smart card and fingerprint
D. Key fob and smart card
Smart card and fingerprint
Andy is attempting to change his password and has created the following long password:
p7djkqnr2LAD
He recieves an error message that he must use a symbol in his password. Which password policy is he failing to meet?
A. Password length
B. Password history
C. Password complexity
D. Password reuse
Password complexity
