Chapter 3: Identity and Access Management Flashcards
-identify: each person needs some form of identification so they can prove who they are.
-authentication: the second part after proving identity is to provide authentication for that identity. Example—smart card—PIN
-authorization: once the individual has been authenticated they are given access level based on their job.
-accounting: RADIUS/DIAMETER/TACACS+
Identity and Access Management (IAM)
Username/Attribute/Smart Card/Certificates/Token/SSH Keys
Identity Types
a credit card token with a certificate embedded on a chip; it is used in conjunction with a PIN
Smart Card
this is a digital token that can either be a SAML token for federation services or a token used by Open Authentication (OAuth)
Token
requires time synchronization because the password needs to be used in a very short period, normally between 30 and 60 seconds.
Example—gives you a code to use within 30 seconds
-type of authentication
-It is commonly used by online services, banks, and websites that need to protect sensitive user accounts from unauthorized access.
Time-Based One-Time Password (TOTP)
is similar to TOTP in that a one time password is issued. The main distinguishing factor is that there is no restriction in terms of time, but you can only use this password once.
-type of authentication
–It is commonly used in hardware tokens or offline authentication methods where devices cannot synchronize with a time server.
HMAC-Based One Time Password (HOTP)
are used by the government and military personnel. They are similar to smart cards. On the front side, a CAC is a picture of the user with their service, and the reverse shows their blood group and their Geneva Convention Category.
Common Access Card (CAC)
this is very similar to the CAC but is used by federal agencies rather than the military.
Personal Identify Verification (PIV)
uses Ticket Granting Ticket (TGT) session that results in a service ticket that can be exchanged for a session ticket to give access to servers such as an Exchange Server.
Kerberos
can be a removable device that can be attached to a computer or server via a USB connection. They are used to store encryption keys, a key escrow that holds the private keys for third parties and stores them in an HSM.
Hardware Security Module (HSM)
this is normally used by banks, financial institutions, or email providers to identify someone when they want a password reset. There are two types of KBA, dynamic and static, and they have their strengths and weaknesses.
Knowledge Based Authentication (KBA)
these are questions that are common to the user. For example “what is the name of your first school”
Static KBA
these are deemed to be more secure because they do not consist of questions provided beforehand. Example—a bank wants to confirm the identity of a customer and they ask the customer to name three direct debit mandates, the date, and amount paid.
Dynamic KBA
authentication framework allowing point to point connections. These are commonly used with wireless connection.
Extensible Authentication Protocol (EAP)
is a version of EAP that encapsulates data I the TLS tunnel, ensuring it is secure for WLANS. PEAP only needs a certificate installed on the server.
Protected Extensible Authentication Protocol (PEAP)
Flexible Authentication Secure Tunneling, developed by CISCO, does not use certificates but protected access credentials instead. It is used in wireless networks.
EAP-FAST
