Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1 Access Control Vocab > Flashcards

Domain 1 Access Control Vocab Flashcards

2
Q

Discretionary access control

A

gives subjects full control of objects they have been given access to, including sharing the objects with other subjects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Mandatory access control

A

system enforced access control based on subject’s clearances and object’s labels.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Role-based access control

A

subjects are grouped into roles, and each defined role has access permissions based upon the role, not the individual.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CIA Triad

A

confidentiality, integrity, and availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Confidentiality

A

seeks to prevent the unauthorized disclosure of information; it keeps data secret. In other words, confidentiality seeks to prevent unauthorized read access to data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Integrity

A

seeks to prevent an authorized modification of information. In other words, integrity seeks to prevent unauthorized write access to data. There are two types of integrity: data integrity and system integrity. Data integrity seeks to protect information against unauthorized modification; system integrity seeks to protect a system such as Windows 2008 server operating system from unauthorized modification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Availability

A

ensures that information is available when needed. Systems need to be usable for normal business use. An example of an attack on availability would be a denial of service attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

DAD

A

Disclosure, Alteration, and Destruction. The opposing force to the CIA Triad.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

AAA

A

Authentication, Authorization, and accountability. Identification is understood with all three.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Subjects, objects, access permissions

A

Three important access control concepts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Subjects

A

Entities that may be assigned permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Objects

A

Types of resources that subjects may access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Access permissions

A

Relationships between subjects and the objects they may access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Four phases of access control.

A

Identification, authentication, authorization, accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Identification

A

User makes a claim as to his or her identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Authentication

A

User proves his or her identity using one or more mechanisms. Providing an identity claim.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Authorization

A

System makes decisions about what resources the user is allowed to access and the manner in which they may be manipulated. Allowing authenticated subjects access to a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Accountability

A

System keeps an accurate audit trail of the users activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Non-Repudiation

A

a user cannot deny (repudiate) having performed a transaction. Authentication with integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Defense in Depth or Layered Defense

A

applies multiple safeguards or controls to protect an asset. Multiple controls will increase your chances of security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Subject

A

an active entity on an information system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

object

A

a passive data file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Three types of access control models

A

MAC, DAC, NDAC (RBAC),

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Mandatory access control (MAC)

A

Authorization of the subjects access to an object depends on labels which indicate a subjects clearance and the classification or sensitivity of the related object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Discretionary access control (DAC)

A

Access control type where the subject has authority to specify what objects can be accessible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Non-discretionary access control (NDAC) also known as role based access control (RBAC)

A

Access control type where the Administrator determines which subjects can have access to certain objects based on an organizations security policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Task based access control

A

based on the tasks that each subject must perform. Focus on tasks rather than roles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Content and Context-based access controls

A

adds additional criteria beyond identification and authentication: the actual content the subject is attempting to access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Centralized access control

A

concentrates access control in one logical point for a system or organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Decentralized access control

A

allows IT admin to occur closer to the mission and operations of an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Access Aggregation

A

Occurs as individual users gain more access to more systems. Authorization creep - gaining more entitlements without shedding the old ones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

RADIUS

A

Access Control Protocol. Remote Authentication Dial In User Service. Third party authentication system. Request for Comments 2865 and 2866. User Datagram Protocol ports 1812(authentication) 1813(accounting). AAA system comprised of three components: Authentication, authorization, and accounting. Request and response data is carried in Attribute-Value Pairs (AVPs).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Diameter

A

Successor to RADIUS. Uses Attribute-Valued Pairs but supports more. Used 32 bits. Uses single server to manage policies for many services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

TACACS and TACACS+

A

Terminal Access Controller Access Control System. Centralized access control system that requires users to send an ID and static reusable password for authentication. Uses UDP port 49 and may also use Transmission Control Protocol. TACACS+ is not backward compatible. TACACS+ encrypts all data below the header.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Labels

A

These are the security level assigned to objects - confidential, secret, top secret.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Clearance

A

a determination by senior security professional about whether a subject can be trusted to have access to objects with labels. Can you be trusted to access classified data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Least Privilege

A

users should be granted the minimum amount of access (authorization) required to do their jobs, but no more. Need to know is more granular than lest privilege, as the user must need to know that specific piece of information before accessing it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Separation of Duties

A

aka segregation of duties. Allows for an organization to maintain checks and balances among the employees with privileged access. No one person has total control over sensitive transactions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Rotation of Duties

A

a process that requires different staff members to perform the same duties. Helps to mitigate collusion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Formal Access approval

A

Documented approval from the data owner for a subject to access certain objects, requiring the subject to understand all the rules and requirements for accessing data and consequences should the data become lost, destroyed, or compromised.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Need to Know

A

Does the user need to know the specific data he may attempt to access. Based on each individual object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Rule based access control

A

system uses a series of defined rules, restrictions, filters for accessing objects within a system. The rules form if/then statements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Access control list (ACL)

A

Contains access control entities (ACEs) that correspond to access permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Six types of access controls.

A

Preventative, detective, corrective, recover, deterrent, compensatory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Preventative controls

A

Controls designed to prevent unwanted activity from occurring.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Detective controls

A

Type of controls that provide a means of discovering unwanted activities that have occurred.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Corrective controls

A

Controls that are mechanisms for bringing a system back to its original state prior to the unwanted activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Recovery

A

After a security incident, recovery controls may have to be taken in order to restore functionality to the system or organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Deterrent controls

A

Control type used to discourage individuals from attempting to perform undesired activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Compensatory controls

A

Control type implemented to make up for deficiencies in other controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Credential Set

A

term used for a combination of both identification and authentication of a user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Three authentication factors.

A

Something you know, something you have, something you are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Passwords

A

The most commonly implemented authentication technique. Something you know.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Static password token

A

Token type where the owner authenticates himself to the token and the token authenticates the owner to the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Four different kinds of tokens

A

Static password, synchronous dynamic password, asynchronous dynamic password, challenge-response token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Static password

A

Reusable passwords that may or may not expire. They are typically user generated and work best when combined with another authentication type, such as a smart card or biometric control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Pass phrases

A

Long static passwords, comprised of words or phrases in a sentence. easier to remember than just one word.

59
Q

One time passwords

A

may be used for a single authentication. very secure but difficult to manage.

60
Q

Dynamic Password

A

change at regular intervals. One draw back is their expense.

61
Q

Strong Authentication

A

aka Multifactor Authentication. Requires that the user present more than one authentication factor. Like your ATM card and PIN.

62
Q

Hashing

A

One way encryption using an algorithm and no key. It is impossible to reverse the algorithm.

63
Q

Password Cracking

A

an attacker runs the hash algorithm forward many times selecting various possible passwords and comparing the output to the desired hash, hoping to find a match.

64
Q

Password Hash storage

A

UNIX/Linux stored in the /etc./shadow file. MS security account management file or SAM.

65
Q

Three categories of access control.

A

Administrative, logical/technical, physical.

66
Q

Administrative controls

A

Controls constituting policies, procedures, disaster recovery plans, awareness training, security reviews and audits, background checks, reviews of vacation history, separation of duties, and job rotation.

67
Q

Logical/technical controls

A

Control type that restricts access to systems and the protection of information.

68
Q

Physical controls

A

Type of controls used to protect access to the physical facilities housing information systems.

69
Q

Principle of least privilege

A

States that the subjects of an access control system should have the minimum set of access permissions necessary to complete their assigned job functions.

70
Q

Separation of duties

A

The ability to perform critical system functions should be divided among different individuals to minimize the risk of collusion.

71
Q

Need to know

A

Users should only have access to information that they have a need to know to perform their assigned responsibilities.

72
Q

Six types of attack.

A

Brute force, dictionary, spoofing, denial of service, man in the middle, sniffer.

73
Q

Brute force attack

A

The type of attack where the attacker simply guesses passwords until eventually succeeding. calculates output for every possible password. They use Rainbow Tables - a database that contains precomputed hashed output for most or all possible passwords.

74
Q

Dictionary attack

A

Type of attack where the attacker uses the password encryption algorithm to encrypt a dictionary of common words and then compares the encrypted words to the password file.

75
Q

Hybrid Attack

A

appends, pretends or changes characters in a words from dictionaries before hashing to attempt the fastest crack of complex passwords

76
Q

salt

A

allows one password to hash in multiple ways

77
Q

Spoofing

A

Type of attack where an individual or system poses as a third party.

78
Q

Denial of service (DoS)

A

Type of attack where the system is flooded with traffic so that it cannot provide service to legitimate users.

79
Q

Sniffer

A

Type of attack where the attacker can monitor all traffic occurring on the same network segment,

80
Q

Token

A

an object that helps to prove and identity claim. Something you have!

81
Q

Synchronous dynamic token

A

time or counters to synchronize a displayed token code with the code expected by the authentication server; the codes are then synchronized.

82
Q

Asynchronous dynamic token

A

Not synchronized with a central server. The most common variety is challenge=response tokens. Challenge-response token authentication systems produce a challenge, or input for the token device. The user then manually enters the information into the device along with the user’s PIN and the device produces an out put.

83
Q

Two-factor authentication

A

Using at least two authentication factors.

84
Q

Challenge-response token

A

Token type where there is a system or workstation generated random number challenge, owner enters string into token with the proper PIN, and the token generates a response that is entered into the system.

85
Q

Biometrics

A

Something you are. uses physical characteristics as a means of identification or authentication.

86
Q

Enrollment time, throughput rate, acceptability

A

Three evaluation factors for biometric techniques.

87
Q

Enrollment time

A

The amount of time that it takes to add a new user to a biometric system.

88
Q

Throughput rate

A

The number of users that may be authenticated to a biometric system per minute.

89
Q

Acceptability

A

The likelihood that users will accept the use of a biometric technique.

90
Q

False rejection rate (FRR), also known as a Type I error

A

The percentage of cases in which a valid user is incorrectly rejected by the system.

91
Q

False acceptance rate (FAR), also known as a Type II error

A

The percentage of cases in which an invalid user is incorrectly accepted by the system.

92
Q

Crossover error rate (CER)

A

The rate at which FRR=FAR for any given system.

93
Q

Finger Prints

A

Most widely used biometric control available today. Smartcards can carry this info. the higher the minutiae the more FRRs one will get.

94
Q

Retina Scan

A

Laser scan of the capillaries that feed the retina in the back of your eye. Requires a light beam to be enter your pupil. Exchange of body fluids possible. Rarely used due to privacy concerns and health issues.

95
Q

Iris Scan

A

camera takes a picture of your iris the colored part of your eye. Non evasive

96
Q

Hand Geometry

A

measurements are made from specific points on your hand

97
Q

Key board dynamics

A

measurements are taken in regards to how one uses a keyboard. Hard to duplicate.

98
Q

Dynamic signatures

A

Measurements are taken in how one signs their name.

99
Q

voiceprint

A

measures the subjects tone of voice while saying specific words. voice can change due to illness.

100
Q

Facial Scan

A

taking the picture of subject and comparing it to what is in the data base. high coast

101
Q

Someplace you are

A

GPS, IP address, point of sale. all these things can help in authenticating an identity.

102
Q

Single sign on (SSO)

A

A subject may authenticate once for access to multiple systems. Allows multiple systems to use a central authentication server (AS). This allows users to authenticate once and then access multiple different systems. It also allows sec admin to add, change, or revoke user privileges on one central system.

103
Q

Single sign on (SSO) Benefits

A
  1. Improved user productivity. 2. Improved developer productivity. 3. Simplified Administration.
104
Q

Single sign on (SSO) Disadvantages

A

1 Difficult to retro fit. 2. unattended desktop can lead to a compromise of entire system. 3. It is a perfect single point of attack for denial of service.

105
Q

Privilege creep

A

Users gain different access permissions as they move from position to position in an organization but old permissions are not revoked.

106
Q

Kerberos

A

Software used on a network to establish a users identity. Third-party authentication system. Developed under Project Athena at MIT.

107
Q

Kerberos Characteristics

A

Current version is 5.

108
Q

Kerberos - Principal

A

Client (user) service.

109
Q

Kerberos - Realm

A

Logical Kerberos network

110
Q

Kerberos - Ticket

A

Data that authenticated a principal’s identity

111
Q

Kerberos - Credentials

A

a ticket or service key.

112
Q

Kerberos - KDC

A

Key distribution center, which authenticates principals.

113
Q

Kerberos - TGS

A

Ticket Granting Service

114
Q

Kerberos - TGT

A

Ticket Granting Ticket Good for a specific lifetime - often 10 hrs.

115
Q

Kerberos - C/S

A

Client/server, regarding communications between the two.

116
Q

Kerberos Operational Steps

A
  1. Principal contacts the KDC, which acts as an authentication server, to request authentication. 2. KDC sends principal a session key, encrypted with secret key. The KDC also sends a TGT encrypted with the TGS secret key. 3. principal decrypts the session key and uses it to print from the TGS.4 Seeing a valid session key, the TGS sends principal a C/S session key to use to print. The TGS also sends a service ticket, encrypted with the printer’s key. 5. Principal connects to printer. Printer sees valid C/S session key. Knows that principal has permission and is authentic.
117
Q

Kerberos Strengths

A

Kerberos mitigates replay attacks (where attackers sniff Kerberos credentials and replay them on the network) via timestamps. In addition to mutual authentication Kerberos is stateless. Any credentials issued by the KDC to TGS are good for the credentials lifetime, even if the KDC to TGS goes down.

118
Q

Kerberos Weakness

A

KDC stores the keys of all principals. A compromise of the KDC can lead to the compromise of every key in the Kerberos realm. KDC and TGS are single points of failure. Kerberos is designed to mitigate a malicious network; a sniffer will provide little or no value. Kerberos does not mitigate a malicious local host, as plaintext keys may exist in the memory or cache.

119
Q

Three components of Kerberos

A

Key distribution center (KDC), Authentication service (AS), Ticket granting service (TGS)

120
Q

SESAME

A

(Secure European System for Applications in a multivendor Environment) A public key based alternative to Kerberos. SSO. Adds to Kerberos with asymmetric encryption. Uses Privilege Attribute Certificates (PAC) in place of Kerberos tickets.

121
Q

Security Audit Logs

A

Logs within the system that access control mechanism to validate adequate performance.

122
Q

Hackers

A

a malicious or inquisitive meddler who tries to discover information by poking around. Cracker is also used to identify one with malicious intent.

123
Q

Black Hat

A

Hacker with malicious intent

124
Q

White Hat

A

Hacker who may be testing the integrity of a system. Ethical and helpful sort.

125
Q

Grey Hat

A

Hacker who exploits a security weakness in a computer system or product in order to bring the weakness to the attention of the owners.

126
Q

Script Kiddies

A

Those who attack a system with tools who have little or no understanding of.

127
Q

Outsiders

A

Unauthorized attackers with no authorized privileged access to a system or organization. The outsider seeks to gain unauthorized access.

128
Q

Insider attack

A

launched by an internal user who may be authorized to use the system that is attacked. Can be mistakes or malice that cause these.

129
Q

Hacktivist

A

Hacker activist, someone who attackes computer systems for political reasons

130
Q

Bot

A

a computer system running malware that is controlled via a botnet. Zombie can also be a term used for a bot.

131
Q

Botnet

A

a central command and control network managed by humans called bot herders. Use IRC - internet relay chat - networks to provide command and control. May also use HTTP, or HTTPS, or propietary protocols.

132
Q

Phisher

A

a malicious attacker who attempts to trick users into divulging account credentials or PII. Many attempt to steal online banking information.

133
Q

Spear Phishing

A

target fewer users. High value targets many times executives. Use their full names, title, and other supporting information. AKA whaling or whale hunting

134
Q

Vishing

A

voice phishing. VoIP systems to automate calls to thousands of targets in attempts to get them to divulge personal banking info.

135
Q

Penetration test

A

An effective way to assess the security of a system.

136
Q

social engineering

A

using the human mind to bipass security controls. i.e. emailing malware with the subject line, “CAT 5 Hurricane to hit Florida!”

137
Q

zero knowledge or Black Box

A

Test is blind. Penetration tester begins with no external or trusted information and begins the attack with public information only

138
Q

Full Knowledge or Crystal Box

A

provides internal informaiton to the tester, including network diagrams, policies and procedures, and sometimes reports from pervious penetration testers.

139
Q

Partial knowledge

A

tester gets some info.

140
Q

Penetration testing tools

A

open source - metasploit.org closed source - core impact and immunity canvas.

141
Q

Vulnerablity Scanning or testing

A

using tools to scan a network or system for misnconfigurations, outdated software, lack of patching. Nessu or OpenVAS.

142
Q

Security Audit

A

test against a published standard. i.e. Payment Card Industry Data Security Standard. PCI DSS for complinace.

143
Q

Security Assessment

A

holistic approach to assessing the effectiveness of access control. View many controls over multiple domains: policies, proceedures, and admin controls; assessing the real world effectiveness of admin controls; change management; architectural review; penetration tests; vulnerablity assessments; security audits.

CISSP (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions