CISSP Domain 1 Access Control Vocab Flashcards
Discretionary access control
gives subjects full control of objects they have been given access to, including sharing the objects with other subjects.
Mandatory access control
system enforced access control based on subject’s clearances and object’s labels.
Role-based access control
subjects are grouped into roles, and each defined role has access permissions based upon the role, not the individual.
CIA Triad
confidentiality, integrity, and availability.
Confidentiality
seeks to prevent the unauthorized disclosure of information; it keeps data secret. In other words, confidentiality seeks to prevent unauthorized read access to data.
Integrity
seeks to prevent an authorized modification of information. In other words, integrity seeks to prevent unauthorized write access to data. There are two types of integrity: data integrity and system integrity. Data integrity seeks to protect information against unauthorized modification; system integrity seeks to protect a system such as Windows 2008 server operating system from unauthorized modification.
Availability
ensures that information is available when needed. Systems need to be usable for normal business use. An example of an attack on availability would be a denial of service attack.
DAD
Disclosure, Alteration, and Destruction. The opposing force to the CIA Triad.
AAA
Authentication, Authorization, and accountability. Identification is understood with all three.
Subjects, objects, access permissions
Three important access control concepts.
Subjects
Entities that may be assigned permissions.
Objects
Types of resources that subjects may access.
Access permissions
Relationships between subjects and the objects they may access.
Four phases of access control.
Identification, authentication, authorization, accounting
Identification
User makes a claim as to his or her identity.
Authentication
User proves his or her identity using one or more mechanisms. Providing an identity claim.
Authorization
System makes decisions about what resources the user is allowed to access and the manner in which they may be manipulated. Allowing authenticated subjects access to a system
Accountability
System keeps an accurate audit trail of the users activity.
Non-Repudiation
a user cannot deny (repudiate) having performed a transaction. Authentication with integrity
Least Privilege
users should be granted the minimum amount of access (authorization) required to do their jobs, but no more. Need to know is more granular than lest privilidge, as the user must need to know that specific pieve of information before accessing it.
Defense in Depth or Layered Defense
applies multiple safegards or controls to protect an asset. Mulitple controls will increase your chances of secutiry.
Subject
an active entity on an information system.
object
a passive datafile.
Access control list (ACL)
Contains access control entities (ACEs) that correspond to access permissions.
Three types of access control modles
MAC, DAC, NDAC (RBAC),
Mandatory access control (MAC)
Authorization of the subjects access to an object depends on labels which indicate a subjects clearance and the classification or sensitivity of the related object
Discretionary access control (DAC)
Access control type where the subject has authority to specify what objects can be accessible.
Non-discretionary access control (NDAC) also known as role based access control (RBAC)
Access control type where the Administrator determines which subjects can have access to certain objects based on an organizations security policy.
Task based access control
based on the tasks that each subject must perform. Focus on tasks rather than roles.
Content and Context-based access controls
adds additional criteria beyond identirfication and authentication: the actual content the subject is attempting to access.
Centralized access control
concentrates access control in one logical point for a system or organization.
Decentralized access control
allows IT admin to occure closer to the mission and operations of an organization.
Single sign on (SSO)
A subject may authenticate once for access to multiple systems.
Access Aggrigation
Occures as individual users gain more access to more systems. Authorization creep - gaining more entitlements without sheding the old ones.
RADIUS
Access Control Proticol. Remote Authentication Dial In User Service. Third party authentication system. Request for Comments 2865 and 2866. User Datagram Protocol ports 1812(authentication) 1813(accounting). AAA system comprised of three components: Authentication, authorization, and accounting. Request and response data is carried in Attribute-Value Pairs (AVPs).
Diameter
Successor to RADIUS. Uses Attribute-Valued Pairs but supports more. Used 32 bits. Uses single server to manage policies for many services.
TACACS and TACACS+
Terminal Access Controller Access Control System. Centralized access control system that requires users to send an ID and static reusable password for authentication. Uses UDP port 49 and may also use Transmission Control Protocol. TACACS+ is not backward compatible. TACACS+ encrypts all data below the header.
Five types of access controls.
Preventative, detective, corrective, deterrent, compensatory
Preventative controls
Controls designed to prevent unwanted activity from occurring.
Detective controls
Type of controls that provide a means of discovering unwanted activities that have occurred.
Corrective controls
Controls that are mechanisms for bringing a system back to its original state prior to the unwanted activity.
Deterrent controls
Control type used to discourage individuals from attempting to perform undesired activities.
Compensatory controls
Control type implemented to make up for deficiencies in other controls.
Three categories of access control.
Administrative, logical/technical, physical.
Administrative controls
Controls constituting policies, procedures, disaster recovery plans, awareness training, security reviews and audits, background checks, reviews of vacation history, separation of duties, and job rotation.
Logical/technical controls
Control type that restricts access to systems and the protection of information.
Physical controls
Type of controls used to protect access to the physical facilities housing information systems.
Principle of least privilege
States that the subjects of an access control system should have the minimum set of access permissions necessary to complete their assigned job functions.
Separation of duties
The ability to perform critical system functions should be divided among different individuals to minimize the risk of collusion.
Need to know
Users should only have access to information that they have a need to know to perform their assigned responsibilities.
Privilege creep
Users gain different access permissions as they move from position to position in an organization but old permissions are not revoked.
Kerberos
Software used on a network to establish a users identity.
Three components of kerberos
Key distribution center (KDC), Authentication service (AS), Ticket granting service (TGS)
SESAME
A public key based alternative to kerberos
Three authentication factors.
Something you know, something you have, something you are
Two-factor authentication
Using at least two authentication factors.
Passwords
The most commonly implemented authentication technique.
Four different kinds of tokens
Static password, synchronous dynamic password, asynchronous dynamic password, challenge-response token
Static password token
Token type where the owner authenticates himself to the token and the token authenticates the owner to the system.
Synchronous dynamic password token
Token type where the token generates a new unique password at fixed time intervals, user enters a unique password and user name into the system, and the system confirms that the password and user name are correct and were entered during the allowed time interval.
Asynchronous dynamic password token
Same as the synchronous dynamic password token except no time dependency.
Challenge-response token
Token type where there is a system or workstation generated random number challenge, owner enters string into token with the proper PIN, and the token generates a response that is entered into the system.
False rejection rate (FRR), also known as a Type I error
The percentage of cases in which a valid user is incorrectly rejected by the system.
False acceptance rate (FAR), also known as a Type II error
The percentage of cases in which an invalid user is incorrectly accepted by the system.
Crossover error rate (CER)
The rate at which FRR=FAR for any given system.
Enrollment time, throughput rate, acceptability
Three evaluation factors for biometric techniques.
Enrollment time
The amount of time that it takes to add a new user to a biometric system.
Throughput rate
The number of users that may be authenticated to a biometric system per minute.
Acceptability
The likelihood that users will accept the use of a biometric technique.
Six types of attack.
Brute force, dictionary, spoofing, denial of service, man in the middle, sniffer.
Brute force attack
The type of attack where the attacker simply guesses passwords until eventually succeeding.
Dictionary attack
Type of attack where the attacker uses the password encryption algorithm to encrypt a dictionary of common words and then compares the encrypted words to the password file.
Spoofing
Type of attack where an individual or system poses as a third party.
Denial of service (DoS)
Type of attack where the system is flooded with traffic so that it cannot provide service to legitimate users.
Sniffer
Type of attack where the attacker can monitor all traffic occurring on the same network segment,
Penetration test
An effective way to assess the security of a system.
Two types of monitored environment for IDS.
Host based, network based
Two types of detection methodology for IDS.
Signature based, Anomaly based
Host based IDS
IDS that resides on a single system and monitors the systems even log and audit trail for signs of unusual activity.
Network based IDS
IDS that performs real time monitoring in a passive manner by monitoring all of the traffic on a specific network segment,
Signature based IDS
IDS that stores characteristics of an attack and then compares activity in a monitored environment to those characteristics.
Anomaly based IDS
IDS that measures user, system, and network behavior over an extended period of time to develop baselines.
