Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Domain 2 – Access Control Systems > Flashcards

Domain 2 – Access Control Systems Flashcards

1
Q

Confidentiality

A

Not disclosed to unauthorized person

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Integrity

A
  • Prevention of modification by unauthorized users
  • Prevention of unauthorized changes by otherwise authorized users
  • Internal and External Consistency
  • Internal Consistency within the system (i.e. within a database the sum of subtotals is equal to the sum of all units)
  • External Consistency – database with the real world (i.e. database total is equal to the actual inventory in the warehouse)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Availability

A

Timely access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Three things to consider

A
  • Threats – potential to cause harm
  • Vulnerabilities – weakness that can be exploited
  • Risk – potential for harm
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Controls-Preventative

A

prevent harmful occurrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Controls-Detective

A

detect after harmful occurrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Controls-Corrective

A

restore after harmful occurrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Controls-Administrative

A

polices and procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Controls-Logical or Technical

A

restricted access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Controls-Physical

A

locked doors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Mandatory access control (MAC)

A

Authorization of subject’s access to an object depends on labels (sensitivity levels), which indicate subject’s clearance, and the classification or sensitivity of the object
• Every Object is assigned a sensitivity level/label and only users authorized up to that particular level can access the object
• Access depends on rules and not by the identity of the subjects or objects alone
• Only administrator (not owners) may change category of a resource — Orange book B-level
• Output is labeled as to sensitivity level
• Unlike permission bits or ACLs, labels cannot ordinarily be changed
• Can’t copy a labeled file into another file with a different label
• Rule based AC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q
  1. Discretionary Access Control (DAC)
A

Subject has authority, within certain limits, to specify what objects can be accessible (e.g., use of ACL)
• User-directed means a user has discretion
• Identity-based means discretionary access control is based on the subjects identity
• Very common in commercial context because of flexibility
• Orange book C level
• Relies on object owner to control access
• Identity Based AC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q
  1. Non-Discretionary Access Control
A

Central authority determines what subjects can have access to certain objects based on organization’s security policy (good for high turnover)
• May be based on individual’s role in the organization (Role-Based) or the subject’s responsibilities or duties (task-based)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Lattice based

A

provides least access privileges of the access pair
• Greatest lower bound
• Lowest upper bound

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Administrative Preventative

A

Policies and procedures, pre-employment background checks, strict hiring practices, employment agreements, friendly and unfriendly employee termination procedures, vacation scheduling, labeling of sensitive materials, increased supervision, security awareness training, behavior awareness, and sign-up procedures to obtain access to information systems and networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Administrative Detective

A

Polices and procedures, job rotation, sharing of responsibilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Technical Preventative

A

Logical system controls, smart cards, bio-metrics, menu shell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Technical Detective

A

IDS, logging, monitoring, clipping levels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Physical Preventative

A

Restrict physical access, guards, man trap, gates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Physical Detective

A

Motion detectors, cameras, thermal detectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Identification

A

establishes accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Three Factor Authentication

A
  • Something you know (password)
  • Something you have (token)
  • Something you are (biometrics)
  • Sometimes - something you do
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Passwords

A
  • Static – same each time

* Dynamic – changes each time you logon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Tokens – Smartcards

A

Static Password (like software with pin)
• Owner Authenticates to the token
• Token authenticates to the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Synchronous Dynamic Password

A
  • Token – generates passcode value
  • Pin – user knows
  • Token and Pin entered into PC
  • Must fit in valid time window
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Asynchronous

A

• Similar to synchronous, new password is generated asynchronously, No time window

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Challenge Response

A
  • System generates challenge string
  • User enters into token
  • Token generates response entered into workstation
  • Mechanism in the workstation determines authentication
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

False Rejection Rate (FRR)

A

Type I error

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

FAR

A

Crossover Error Rate – (CER) – CER = % when FRR = FAR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Biometric Issues

A
  • Enrollment Time – Acceptable rate is 2 minutes per person

* Throughput Time – acceptable rate is 10 people per minute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Acceptability Issues

A

privacy, physical, psychological

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Types of Biometrics-Fingerprints

A

Are made up of ridge endings and bifurcations exhibited by the friction ridges and other detailed characteristics that are called minutiae.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Types of Biometrics-Retina Scans

A

Scans the blood-vessel pattern of the retina on the backside of the eyeball.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Types of Biometrics-Iris Scans

A

Scan the colored portion of the eye that surrounds the pupil.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Types of Biometrics-Facial Scans

A

Takes attributes and characteristics like bone structures, nose ridges, eye widths, forehead sizes and chin shapes into account.

36
Q

Types of Biometrics-Palm Scans

A

The palm has creases, ridges and grooves throughout it that are unique to a specific person.

37
Q

Types of Biometrics-Hand Geometry

A

The shape of a person’s hand (the length and width of the hand and fingers) measures hand geometry.

38
Q

Types of Biometrics-Voice Print

A

Distinguishing differences in people’s speech sounds and patterns.

39
Q

Types of Biometrics-Signature Dynamics

A

Electrical signals of speed and time that can be captured when a person writes a signature.

40
Q

Types of Biometrics-Keyboard Dynamics

A

Captures the electrical signals when a person types a certain phrase.

41
Q

Types of Biometrics-Hand Topology

A

Looks at the size and width of an individual’s hand and fingers.

42
Q

Kerberos…

A

Kerberos-Symmetric key encryption

43
Q

Kerberos-KDC

A

Kerberos-trusted Key Distribution Center

44
Q

Kerberos-TGS

A

Ticket Granting Service

45
Q

Kerberos-AS

A

Authentication Server

46
Q

Kerberos…

A

KDC knows secret keys of Client and Server

47
Q

Kerberos…

A

KDC exchanges info with the Client and the Server using symmetric keys

48
Q

Kerberos…

A

Using TGS grants temporary symmetric key

49
Q

Kerberos-Initial Exchange

A

Client sends Hash Password to the TGS Server, TGS verifies with the Auth. Server
TGS Server responds with:
1) Key for Client and TGS server encrypted with Client Key [K(c,tgs)]Kc
2) Ticket Granting Ticket (TGT) = [K(c, tgs), c,a,v]K(tgs)

50
Q

Kerberos-Request for Service

A

Client sends request for service to TGS with

1) TGT = [K(c, tgs), c,a,v]K(tgs)
2) Authenticator K(c, tgs)

51
Q

Kerberos-TGS Issues Ticket for Service

A

TGS sends Client back ticket for server and authenticator for server

1) Ticket T(c,s) = [s,c,a,v,K(c,s)]Ks
2) [K(c,s)]K(c,tgs)

52
Q

Kerberos-Receive Service from Server

A

Client sends Server

1) Ticket T(c,s) = [s,c,a,v,K(c,s)]Ks
2) authenticator = [c,t,key]K(c,s)

53
Q

Kerberos weaknesses…

A

Replay is possible within time frame

54
Q

Kerberos weaknesses…

A

TGS and Auth server are vulnerable as they know everything

55
Q

Kerberos weaknesses…

A

Initial exchange passed on password authentication

56
Q

Kerberos weaknesses…

A

Keys are vulnerable

57
Q

SESAME

A

Secure European System for Applications in a Multi-vendor Environment
• Uses Needham-Schroeder protocol
• Uses public key cryptography
• Supports MD5 and CRC32 Hashing
• Uses two tickets
1) One contains authentication
2) One contains the access rights to the client

58
Q

SESAME weaknesses…Only authenticates by using first block of message

A

Only authenticates by using first block of message

59
Q

SESAME weaknesses…Initial exchange passed on password authentication

A

SESAME weaknesses…SESAME incorporates two certificates or tickets: One certificate provides authentication as in Kerberos and the other certificate defines the access privileges that are assigned to a client.

60
Q

KryptoKnight

A 
	Peer to peer relationship between KDC – Key Distribution Center and parties (Client and Server)
	NetSP is based on KryptoKnight
	Supported by RACF
•	Authentication 
•	Key Distribution 
•	Data Privacy 
•	Data Integrity 
•	Single Sign-On 
•	Administration
61
Q

Centralized ACL-RADIUS

A

Remote Access Dial-In User Service (incorporates an AS and dynamic password)

62
Q

Centralized ACL-TACACS

A

Terminal Access Controller Access Control System (for network applications, static pwd)

63
Q

Centralized ACL-TACACS+

A

Terminal Access Controller Access Control System Plus, supports token authentication

64
Q

Centralized ACL-CHAP

A

Challenge Handshake Authentication Protocol

Supports encryption, protects password

65
Q

Decentralized ACL-Relational Database Security

A
  • Relational Databases support queries

* Object oriented databases do not support queries

66
Q

Relational Database

A
  • Data structures called tables (relations)
  • Integrity Rules on allowable values
  • Operators on the data in tables
67
Q

Persistency

A

preservation of integrity through the use of nonvolatile storage media

68
Q

Schema

A
  • Description of the database

* Defined by Data Description Layer (DDL)

69
Q

DBMS

A

Database Management System
• provides access to the database
• Allows restriction of access

70
Q

Relational Database

A
  • Relation (table) is the basis of a relational database – relation is represented by a table
  • Rows = Records (tuples)
  • Column = Attributes
71
Q

Relational Database-Primary Key

A
  • Unambiguously identifies a record. Points to a record (tuple)
  • Every row (record, tuple) must contain the primary key of the relation (table)
72
Q

Relational Database-Cardinality

A

of rows in a relationship (table)

73
Q

Relational Database-Degree

A

of columns in a relationship (table)

74
Q

Relational Database-Candidate key

A

any identifier that is a unique to the record

75
Q

Relational Database-Foreign Key

A

any value that matches the primary key of another relation (table)

76
Q

Relational Database Operations

A
  • Select – based on criteria i.e. all items with value > $300.00
  • Join - join tables based on a common value
  • Union – forms a new relation (table) from two other relations
  • View – (virtual table) uses join, project, select - Views can be used to restrict access (least privileges)
77
Q

Relational Database Query plan

A
  • Comprised of implementation procedures, lowest cost plan based on “cost”
  • Costs are CPU time, Disk Access
  • Bind – used to create plan
78
Q

Data Normalization

A

Ensures that attributes in a table rely only on the primary key
• Eliminates repeating groups
• Eliminates redundant data
• Eliminates attributes not dependent on the primary key

79
Q

SQL – Structured Query Language

A
  • Select
  • Update
  • Delete
  • Insert
  • Grant – Access Privileges
  • Revoke – Access Privileges
80
Q

OODB

A

Object Oriented Databases:
• Best suited for multi-media, graphics
• Steep learning curve
• High overhead

81
Q

Network Based IDS

A
  • Real Time

* Passive

82
Q

Host Based IDS

A
  • System and event logs

* Limited by log capabilities

83
Q

Signature Based – (Knowledge Based) IDS

A
  • Signatures of an attack are stored and referenced
  • Failure to recognize slow attacks
  • Must have signature stored to identify
84
Q

Statistical Anomaly Based (Behavior Based) IDS

A
  • IDS determines “normal” usage profile using statistical samples
  • Detects anomaly from the normal profile
85
Q

Access Control Issues

A
  • Confidentiality
  • Integrity
  • Availability
  • Accountability of users
86
Q

Measures for compensating for both internal and external access violations

A
  • Backups
  • RAID – Redundant Array of Inexpensive Disks
  • Fault Tolerance
  • Business Continuity Planning
  • Insurance

CISSP (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions