Chapter 2 Concepts

Question 1

Identification

Answer 1

Identification occurs when a user CLAIMS an identity with a username or email address.

Question 2

Authentication

Answer 2

Authentication occurs when the user PROVES the CLAIMED identity with a password or PIN and the credentials are verified.

Question 3

Authorization

Answer 3

Authorization occurs when users are granted access to system resources based on the authentication of the proven identity.

Question 4

Accounting

Answer 4

Accounting is the process of logging the actions that users take in system logs.

Question 5

Authentication Factors

Answer 5

Authentication factors include something you know (password or PIN), something you have (smart cards, hardware tokens), something you are (biometric), somewhere you are (location based), and something you do (gestures on a screen).

Question 6

False Acceptance (Rate)

Answer 6

False acceptance occurs when a biometric system incorrectly identifies an UNAUTHORIZED user as an authorized user. False acceptance rate denotes the percentage of time false acceptance occurs.

Question 7

False Rejection (Rate)

Answer 7

False rejection occurs when a biometric system incorrectly REJECTS an AUTHORIZED user. False rejection rate denotes the percentage of time false rejections occur.

Question 8

Crossover Error Rate

Answer 8

The crossover error rate is the point where the false acceptance rate crosses over with the false rejection rate. A lower crossover error rate indicates that the biometric system is more accurate.

Question 9

Kerberos

Answer 9

Kerberos is a network authentication protocol within a Microsoft Windows Active Directory domain or a Unix realm. It uses a database of objects such as Active Directory and a Key Distribution Center (KDC) or Ticket-Granting Tickets (TGT) server to issue time-stamped tickets that expire a certain period of time. Kerberos uses symmetric-key cryptography to prevent unauthorized disclosure and to ensure confidentiality.

Question 10

New Technology LAN Manager

Answer 10

NTLM is a suite of protocols that provide authentication, integrity, and confidentiality within Windows systems. NTLM has been cracked and is not recommended for use today.

Question 11

Lightweight Directory Access Protocol

Answer 11

LDAP specifies formats and methods to query directories.

Question 12

Single Sign-On

Answer 12

Single sign-on refers to the ability of a user to log on or access multiple systems by providing credentials only once.

Question 13

Security Assertion Markup Language

Answer 13

SAML is an XML-based standard used to exchange authentication and authorization information between different parties. SAML provides single sing-on for web-based applications.

Question 14

Federation

Answer 14

A federation requires two or more parties (companies) to agree on a standard for identities and then exchange information based on that standard. A federated identity links a user’s credentials from different networks or operating systems, but the federation teats it as one identity.

Question 15

Role-Based Access Control

Answer 15

Role-based access control uses roles (or groups) to manage rights and permissions for users. An administrator will create a role (or group), assign specific rights and permissions to that role (or group) then assign individual users to that role (or group).

Question 16

Rule-Based Access Control

Answer 16

Rule-based access control is based on a set of approved instructions, such as an access control list. Some rule-based access control systems use rules that trigger in response to an event, such as modifying access control lists after detecting an attack or granting additional permissions to a user in certain situations.

Question 17

Discretionary Access Control

Answer 17

Discretionary access control specifies that every object (such as file and folders) has an owner, and the owner has full, explicit control of the object.

Question 18

Mandatory Access Control

Answer 18

Mandatory access control uses sensitivity or security labels for users and data. Administrators assign labels to users and objects and when the labels match, the system can grant a user access to an object.

Question 19

Attribute-Based Access Control

Answer 19

Attribute-based access control evaluates attributes and grants access based on the value of these attributes. Access to certain objects may require the user to have “employee, inspector, nuclear aware” attributes in order to access certain objects.