Chapter3 Flashcards
1
Q
RFC 4949 describe user authentication as:
A
The process of verifying an identity claimed by or for a system entity
2
Q
Authentication Process
A
- Fundamental building block and primary line of defense
- Basis of access control and user accountability
3
Q
Step of authentication process:
A
- Identification Step
- Verification Step
4
Q
Identification Step
A
- Presenting an identifier to the security system
5
Q
Verification Step
A
- Presenting or generating authentication information that corroborates the binding between the entity and the identifier
6
Q
The four means of authenticating user identity are based on:
A
- Something the individual knows
- Something the individual possess
- Something the individual is (Static Biometrics)
- Something the individual does (Dynamic Biometrics)
7
Q
3 separated concepts for Risk assessment for user authentication
A
- Assurance Level
- Potential impact
- Areas of risk
8
Q
Assurance level
A
Describes n organization’s degree of certainty that a user has presented a credential that refers to his or her identity.
9
Q
Levels of Potential Impact
A
- low
- moderate
- High
10
Q
Password Authentication
A
- Widely used line of defense against intruders
11
Q
The User ID:
A
- Determines that the user is authorized to access the system.
- Determines the user’s privileges
- Is used in discretionary access control
12
Q
Password Vulnerabilities:
A
- Offline dictionary attack
- Specific account attack
- Password guessing against single user
- Popular password attack
- Workstation Hijacking
- Exploiting user mistakes
- electronic monitoring
- exploiting multiple password use
13
Q
Unix Implementation Original Scheme
A
- Up to 8 printable characters in length
- 12-bit salt used to modify DES encryption into a one- way hash function
- zero value repeatedly encrypted 25 times
- output translated to 11 character sequence
14
Q
Down side of original unix implementation
A
- now regarded as inadequate.
15
Q
Improved Unix implementatio
A
- much stronger hash/salt schemes
- OpenBSD uses Blowfish block cipher based hash algorithm call Bcrypt
- Recommended hash function is based on MD5
