D3: Access Controls Flashcards
They dictate how subjects access _, adn their main goal is to protect the _ from _ _.
objects
objects; unauthorized access
Access controls can be (3):
1) physical
2) administrative
3) logical
Access control defines:
how users should be identified, authenticated, and authorized
Access control needs to be integrated into the core of operating systems through the use of _, _, and _ models
DAC
MAC
RBAC
How is access control enforced in the physical world?
security zones, network segmentation, locked doors, securit yguards
Access is…
a flow of information between a subject and an object
subject v. object
subject - aactive entity that requests access to an object
object 0 a passive entity
a subject can be a
user, program, process
Access controls are security features that are usually considered the _ _ _ _ in asset protection.
First line of defense
Name security mechanisms that provide confidentiality:
- encryption
- logical and physical access control
- transmission protogol
- database views
- controlled traffic flow
Name some identity management solutions:
- directories
- web access management
- passwrod management
- legacy single sign-on
- account management
- profile update
What is the benefit of password synchronization?
It reduces the complexity of keeping up with different passwords for different systems.
Benefits of self-service password reset:
Reduces help-desk call volumes by allowing users to reset their own passwords
What are the benefits for assisted password reset?
It reduces the resolution process for password issues for the help-desk department
What do IdM directories contain and what’s the purpose?
All resource information, user’s attributes, authorization profiles, roles, and possibly access control policies.
Other IdM applications have one centralized resource from which to gather this information
Automated workflow component is _ in account management products that provide IdM solutiosn
common
User provisioning refers to:
creation, maintenance, and deactivation of user objects and attributes, as they exist in one or more systems, directories, or applications
The HR database is usually considereed the authoritative source for:
user identities. This is where it is first developed and properly maintained
What are the three main access control models?
1 - discretionary
2 - mandatory
3 - role-based
DAC
Discretionary Access Control. Enables data owners to dictate what subjects have access to the files and resources they own.
MAC
Mandatory Access Control.
This model uses a security label system. Users have clearnaces, and resources have security labels that contain data classifications.
MAC systems compare these two attributes to determine access control capabilities.
Role-Based Access Control
Based on the user’s role and responsibiliteis (tasks) within the company
What are the three main tyapes of restricted interface measurements?
1 - menus and shells
2 - database views
3 - physically constrained interfaces
Access control lists are bound to _ and indicate what _ can use them.
objects
subjects
A capability table is bound to a _ and lists what _ it can access.
subject
objects
What are the two man ways that access control can be adminstered?
1 - centralized
2 - decentralized
Provided a decentralized administration access control example:
peer-to-peer working group
Provide some examples of centralized administration access control technologies:
RADIUS
TACACS+
Diameter
Provide examples of administrative controls:
- security policy
- personnel controls
- supervisory structure
- security awareness training
- testing
Provide examples of physical controls
- network segregation
- perimeter security
- computer controls
- work area separation
- cable
Provide examples of technical controls
- system access
- network architecture
- network access
- encryption and protocols
- auditing
For a subject to be able to access a resource it must be:
1 - identified
2 - authenticated
3- authorized
4 - held accountable for its actions
Through what ways can authentication be accomplished?
1 - biometrics 2 - password 3 - passphrase 4 - cognitive password 5 - one-time password 6 - token
Biometrics Type I error =
the system rejected an authorized individual
Biometrics Type II error =
an imposter was authenticated
A _ _ cannot process information, but a _ _ can through the use of integrated circuits and processors
memory card
smart card
What do Least-privilege and need-to-know principles do?
Limit users’ rights to only what is needed to perform tasks of their job
Single sign-on cabailities can be accomplished through:
- Kerberos
- SESAME
- domains
- thin clients
How does Kerberos work?
1 - the Kerberos user receives a ticket granting ticket (TGT) which allows him to request access to resources through the ticket granting service (TGS)
2 - The TGS generates a new ticket with the session keys
User –> TGT –> TGS –> ticket with session keys
Name types of access control attacks
- DoS
- Spoofing
- dictionary
- brute force
- war dialing
KEYSTROKE LOGGING
A type of auditing that tracks each keystroke made by a user
How can object reuse unintentiallly disclose information?
By assigning media to a subject before it is properly erased
Is removing pointers to files (deleting file, formatting hard drive) enough protection for proper object reuse?
No
Information can be obtained via electrical signals in airwaves. The ways to combat this type of intrusion are:
TEMPEST
White noise
control zones
User authentication is accomplished by:
what someone knows, is, or has
One-time password generating token devices can use synchronous (, ) or asynchronous (-) methods
time, event
challenge-based
Strong authentication requires:
two of the three authentication attributes (knows, is, has)
What are the weaknesses of Kerberos:
- the KDC is a single point of failure
- it is susceptible of password guessing
- session and secret keyes are locally stored
- KDC needs to always be available
- there must be management of secret keys
What is phishing?
A type of social engineering with the goal of obtaining personal information, credentials, credit card numbers, or financial data
When is a race condition possible?
When two or more processes use a shared resource and the access steps could take place out of sequence
What is mutual authentication?
When two entities must authenticate to each other before sending data back and forth.
Also referred to as two-way authentication
What is a directory service?
A software component that stores, organizes, and provides access to resources, whicih are listed in a directory (listing) of resources. Individual resources are assigned names within a namespace
Cookie
Data that are held permanently on a hard drive in the format of a text file or held temporariliy in memory. It can be used to store browsing habits, authentication data, or protocol state information
Federated Identity
A portable identity.
Its associated entitelements that can be used across business boundaries without the need to synchronize or consolidate directory information
Extensible Markup Language (XML)
A set of rules for encoding documents in machine-readable form to allow for interoperability between various web-based technologies
Service Provisioning Markup Language (SPML)
An XML-based framework being developed by OASIS
eXtenible Access Control Markup Language (XACML)
A declaritive access control policy language implemented in XML and a processing model, describes how to interpret security policies
Replay attack
A form of network attack in which a valid data transmission is maliciously or fradulently repeated with the goal of obtaining unauthorized access.
Clipping level
A threshold value. Once a threshold is passed, the activity is considred an event that is logged, investigated, or both
RAINBOW TABLE
A set of precomputed hash values that represent password combinations. These are used in password attack processes and usually produce results more quickly than dictionary or brute force attacks.
COGNITIVE PASSWORDS
Fact- or opinion-based information used to verify an individuals identity
Smart cards can require physical interaction with a reader () or no physical interaction with the reader ( _ _ ). Two _ _ are combi ( ) and hybrid ( _).
contact contactless architecture contactless architectures one chip two chips
How is a side channel attack carried out?
By gathering data pertaining to how something works and using that data to attack or crack it, as in differntial power analysis or electronmagnetic analysis.
When does authorization creep take place?
when a user gains too much access rights and permissions over time.
What is SESAME?
A single sign-on technology developed to address issues in Kerberos. It is based upon publi key cryptography (asymmetic) and uses privileged atribute servers and certs.
Intrusion detection systems are either _ or _ based and provide _ (statistical) or _ (knowledge) types of functionality.
host; network
behavioral; signature
If a DNS server is poisoned and points users to a malicious website, its called:
pharming
A web portal is commonly made up of _, which are pluggale user interface software components that present information and services from other systems
portlets
SPML
Service Provisioning Markup Language.
Allows for the automation of user management (account creation, amendments, revocation) and access entitlement configuration related to electornically published services across mulitple provisioning systems
SAML
Security Assertion Markup Language.
Allows for exchange of authentication and authroization data to be shared between security domains.
SOAP
Simple Object Access Protocol.
For exchanging structured information in the implementation of web services and networked environments.
SOA
Service oreiented architecture.
Allow ofr a suite of interoperable services to be used within multiple, separate systems from several business domains
Threat modeling
identifies potential threats and attack vectors.
vulnerability analysis
identifies weaknesses and lack of countermeasures;
