Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > CISSP Domain 1 Access Control Vocab > Flashcards

CISSP Domain 1 Access Control Vocab Flashcards

1
Q

Discretionary access control

A

gives subjects full control of objects they have been given access to, including sharing the objects with other subjects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Mandatory access control

A

system enforced access control based on subject’s clearances and object’s labels.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Role-based access control

A

subjects are grouped into roles, and each defined role has access permissions based upon the role, not the individual.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

CIA Triad

A

confidentiality, integrity, and availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Confidentiality

A

seeks to prevent the unauthorized disclosure of information; it keeps data secret. In other words, confidentiality seeks to prevent unauthorized read access to data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Integrity

A

seeks to prevent an authorized modification of information. In other words, integrity seeks to prevent unauthorized write access to data. There are two types of integrity: data integrity and system integrity. Data integrity seeks to protect information against unauthorized modification; system integrity seeks to protect a system such as Windows 2008 server operating system from unauthorized modification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Availability

A

ensures that information is available when needed. Systems need to be usable for normal business use. An example of an attack on availability would be a denial of service attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

DAD

A

Disclosure, Alteration, and Destruction. The opposing force to the CIA Triad.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

AAA

A

Authentication, Authorization, and accountability. Identification is understood with all three.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Subjects, objects, access permissions

A

Three important access control concepts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Subjects

A

Entities that may be assigned permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Objects

A

Types of resources that subjects may access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Access permissions

A

Relationships between subjects and the objects they may access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Four phases of access control.

A

Identification, authentication, authorization, accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Identification

A

User makes a claim as to his or her identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Authentication

A

User proves his or her identity using one or more mechanisms. Providing an identity claim.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Authorization

A

System makes decisions about what resources the user is allowed to access and the manner in which they may be manipulated. Allowing authenticated subjects access to a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Accountability

A

System keeps an accurate audit trail of the users activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Non-Repudiation

A

a user cannot deny (repudiate) having performed a transaction. Authentication with integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Least Privilege

A

users should be granted the minimum amount of access (authorization) required to do their jobs, but no more. Need to know is more granular than lest privilidge, as the user must need to know that specific pieve of information before accessing it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Defense in Depth or Layered Defense

A

applies multiple safegards or controls to protect an asset. Mulitple controls will increase your chances of secutiry.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Subject

A

an active entity on an information system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

object

A

a passive datafile.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Access control list (ACL)

A

Contains access control entities (ACEs) that correspond to access permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Three types of access control modles

A

MAC, DAC, NDAC (RBAC),

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Mandatory access control (MAC)

A

Authorization of the subjects access to an object depends on labels which indicate a subjects clearance and the classification or sensitivity of the related object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Discretionary access control (DAC)

A

Access control type where the subject has authority to specify what objects can be accessible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Non-discretionary access control (NDAC) also known as role based access control (RBAC)

A

Access control type where the Administrator determines which subjects can have access to certain objects based on an organizations security policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Task based access control

A

based on the tasks that each subject must perform. Focus on tasks rather than roles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Content and Context-based access controls

A

adds additional criteria beyond identirfication and authentication: the actual content the subject is attempting to access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Centralized access control

A

concentrates access control in one logical point for a system or organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Decentralized access control

A

allows IT admin to occure closer to the mission and operations of an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Single sign on (SSO)

A

A subject may authenticate once for access to multiple systems.

34
Q

Access Aggrigation

A

Occures as individual users gain more access to more systems. Authorization creep - gaining more entitlements without sheding the old ones.

35
Q

RADIUS

A

Access Control Proticol. Remote Authentication Dial In User Service. Third party authentication system. Request for Comments 2865 and 2866. User Datagram Protocol ports 1812(authentication) 1813(accounting). AAA system comprised of three components: Authentication, authorization, and accounting. Request and response data is carried in Attribute-Value Pairs (AVPs).

36
Q

Diameter

A

Successor to RADIUS. Uses Attribute-Valued Pairs but supports more. Used 32 bits. Uses single server to manage policies for many services.

37
Q

TACACS and TACACS+

A

Terminal Access Controller Access Control System. Centralized access control system that requires users to send an ID and static reusable password for authentication. Uses UDP port 49 and may also use Transmission Control Protocol. TACACS+ is not backward compatible. TACACS+ encrypts all data below the header.

38
Q

Five types of access controls.

A

Preventative, detective, corrective, deterrent, compensatory

39
Q

Preventative controls

A

Controls designed to prevent unwanted activity from occurring.

40
Q

Detective controls

A

Type of controls that provide a means of discovering unwanted activities that have occurred.

41
Q

Corrective controls

A

Controls that are mechanisms for bringing a system back to its original state prior to the unwanted activity.

42
Q

Deterrent controls

A

Control type used to discourage individuals from attempting to perform undesired activities.

43
Q

Compensatory controls

A

Control type implemented to make up for deficiencies in other controls.

44
Q

Three categories of access control.

A

Administrative, logical/technical, physical.

45
Q

Administrative controls

A

Controls constituting policies, procedures, disaster recovery plans, awareness training, security reviews and audits, background checks, reviews of vacation history, separation of duties, and job rotation.

46
Q

Logical/technical controls

A

Control type that restricts access to systems and the protection of information.

47
Q

Physical controls

A

Type of controls used to protect access to the physical facilities housing information systems.

48
Q

Principle of least privilege

A

States that the subjects of an access control system should have the minimum set of access permissions necessary to complete their assigned job functions.

49
Q

Separation of duties

A

The ability to perform critical system functions should be divided among different individuals to minimize the risk of collusion.

50
Q

Need to know

A

Users should only have access to information that they have a need to know to perform their assigned responsibilities.

51
Q

Privilege creep

A

Users gain different access permissions as they move from position to position in an organization but old permissions are not revoked.

52
Q

Kerberos

A

Software used on a network to establish a users identity.

53
Q

Three components of kerberos

A

Key distribution center (KDC), Authentication service (AS), Ticket granting service (TGS)

54
Q

SESAME

A

A public key based alternative to kerberos

55
Q

Three authentication factors.

A

Something you know, something you have, something you are

56
Q

Two-factor authentication

A

Using at least two authentication factors.

57
Q

Passwords

A

The most commonly implemented authentication technique.

58
Q

Four different kinds of tokens

A

Static password, synchronous dynamic password, asynchronous dynamic password, challenge-response token

59
Q

Static password token

A

Token type where the owner authenticates himself to the token and the token authenticates the owner to the system.

60
Q

Synchronous dynamic password token

A

Token type where the token generates a new unique password at fixed time intervals, user enters a unique password and user name into the system, and the system confirms that the password and user name are correct and were entered during the allowed time interval.

61
Q

Asynchronous dynamic password token

A

Same as the synchronous dynamic password token except no time dependency.

62
Q

Challenge-response token

A

Token type where there is a system or workstation generated random number challenge, owner enters string into token with the proper PIN, and the token generates a response that is entered into the system.

63
Q

False rejection rate (FRR), also known as a Type I error

A

The percentage of cases in which a valid user is incorrectly rejected by the system.

64
Q

False acceptance rate (FAR), also known as a Type II error

A

The percentage of cases in which an invalid user is incorrectly accepted by the system.

65
Q

Crossover error rate (CER)

A

The rate at which FRR=FAR for any given system.

66
Q

Enrollment time, throughput rate, acceptability

A

Three evaluation factors for biometric techniques.

67
Q

Enrollment time

A

The amount of time that it takes to add a new user to a biometric system.

68
Q

Throughput rate

A

The number of users that may be authenticated to a biometric system per minute.

69
Q

Acceptability

A

The likelihood that users will accept the use of a biometric technique.

70
Q

Six types of attack.

A

Brute force, dictionary, spoofing, denial of service, man in the middle, sniffer.

71
Q

Brute force attack

A

The type of attack where the attacker simply guesses passwords until eventually succeeding.

72
Q

Dictionary attack

A

Type of attack where the attacker uses the password encryption algorithm to encrypt a dictionary of common words and then compares the encrypted words to the password file.

73
Q

Spoofing

A

Type of attack where an individual or system poses as a third party.

74
Q

Denial of service (DoS)

A

Type of attack where the system is flooded with traffic so that it cannot provide service to legitimate users.

75
Q

Sniffer

A

Type of attack where the attacker can monitor all traffic occurring on the same network segment,

76
Q

Penetration test

A

An effective way to assess the security of a system.

77
Q

Two types of monitored environment for IDS.

A

Host based, network based

78
Q

Two types of detection methodology for IDS.

A

Signature based, Anomaly based

79
Q

Host based IDS

A

IDS that resides on a single system and monitors the systems even log and audit trail for signs of unusual activity.

80
Q

Network based IDS

A

IDS that performs real time monitoring in a passive manner by monitoring all of the traffic on a specific network segment,

81
Q

Signature based IDS

A

IDS that stores characteristics of an attack and then compares activity in a monitored environment to those characteristics.

82
Q

Anomaly based IDS

A

IDS that measures user, system, and network behavior over an extended period of time to develop baselines.

CISSP (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions