Domain 5 - Identity and Access Management (IAM) Flashcards
For our new startup, we are looking at different types of identity and access management. Which of these are COMMON types of that? (Select all that apply). A: TRAC (trust access control) B: RUBAC (rule based access control) C: MAC (mandatory access control) D: RBAC (role based access control) E: DAC (discretionary access control)
C and E
In Identity and Access Management we can use DAC (Discretionary Access Control), which is often used when Availability is most important. Access to an object is assigned at the discretion of the object owner. MAC (Mandatory Access Control): Often used when Confidentiality is most important. Access to an object is determined by labels and clearance, this is often used in the military or in organizations where confidentiality is very important. RBAC (Role Based Access Control): Often used when Integrity is most important. Policy neutral access control mechanism defined around roles and privileges. A role is assigned permissions, and subjects in that role are added to the group, if they move to another position they are moved to the permissions group for that position. RUBAC is based on IF/THEN statements (think older firewalls), and is not a type of Identity and Access Management. TRAC is .. well nothing, I made it up 0_o
In Identity and Access Management you would primarily use MAC (Mandatory Access Control) for?
A: availability
B: integrity
C: confidentiality
C: confidentiality
In Identity and Access Management you would primarily use MAC (Mandatory Access Control) for?
A: availability
B: integrity
C: confidentiality
C: confidentiality
In Identity and Access Management you would primarily use RBAC (Role Based Access Control) for?
A: availability
B: integrity
C: confidentiality
B: Integrity
is RUBAC Identity and access management
No, Rule based access control (RUBAC) is based on IF/THEN statements (think older firewalls),
what is HMAC
HMAC (Hash-based Message Authentication Code) is a type of a message authentication code (MAC) that is acquired by executing a cryptographic hash function on the data (that is) to be authenticated and a secret shared key. Like any of the MAC, it is used for both data integrity and authentication
A HMAC-based one-time password (HOTP) is an example of which type of authentication method? A: something you know B: something you are C: somewhere you are D: something you have
D: something you have
Explanation
Something you have - Type 2 Authentication: HOTP (HMAC-based one-time password): Shared secret and incremental counter, generate code when asked, valid till used.
Which of these countermeasures would be the LEAST effective against brute force attacks? A: strong password requirements B: salting C: Key stretching D: limited number of wrong logins
B: salting
Explanation
Salting is adding random characters to passwords before hashing, it does nothing against brute force attacks. Key stretching and limited login attempts are good countermeasures, complex passwords can help, but will eventually be broken.
Which security issue in Kerberos was addressed in SESAME with Public Key Infrastructure (PKI)?
A: symmetric plain text key storage
B: never sending the password over the internet
C: PKI
D: asymmetric plaintext key storage
A: symmetric plaintext key storage Explanation SESAME (Secure European System for Applications in a Multi-vendor Environment): Uses a PAS (Privilege Attribute Server), which issues PACs (Privilege Attribute Certificates) instead of Kerberos’ tickets. It uses PKI encryption (asymmetric), which fixed the Kerberos the plaintext storage of symmetric keys issue.
We are adding random data to our password hashes, to prevent attackers from successfully using rainbow table and dictionary attacks. What are we adding to the hash function?
salting
Explanation
Salting is random data that is used as an additional input to a one-way function that hashes a password or passphrase.
Which of these is the WEAKEST form of authentication we can implement? A: something you know B: biometrics C: something you have D: something you are
A: something you know
Explanation
Something you know - Type 1 Authentication: Passwords, pass phrase, PIN etc., also called Knowledge factors. It is the weakest form of authentication, and can easily be compromised.
When we look at using type 3 authentication, we would talk about all these terms EXCEPT which? A: FAR B: CER C: FRR D: CRR
D: CRR
Explanation
Something you are - Type 3 Authentication (Biometrics), uses Errors for Biometric Authentication: FRR (False rejection rate), FAR (False accept rate) and CER (Crossover Error Rate).
We have found some older systems on our network using CHAP. What could be a reason we would want to migrate away from using CHAP?
A: it uses PPP
B: it uses SSL
C: it stores client passwords on the server, they are never sent over the internet
D: credentials are sent plaintext over the network
C:
Explanation
The CHAP server stores plaintext passwords of each client, an attacker gaining access to the server can steal all the client passwords stored on it.
Jane is looking at the Kerberos implementation we have in place and is working on the Key Distribution Center (KDC). Which of these is part of the KDC? A: TGT B: SWG C: BGP D: TGS
D: TGS
Explanation
The KDC (Key Distribution Center) consists of the AS (Authentication Server) and the TGS (Ticket Granting Server).
An administrator notices a user’s account is being used from across the world and at 0300 in the morning. They know the employee is not out of the country. What is the FIRST thing they should do?
Explanation
The administrator should lock the account, then if deemed appropriate call the user. We would assume the credentials are compromised and we don’t want the attacker to stay on our network.
We have been using Kerberos for some years. Bob is explaining the traffic flow to a new colleague. What does the client send to the TGS? A: session key B: authenticator C: user ID D: plaintext password
B: authenticator
Explanation
When requesting services, the client sends the following messages to the TGS: #1 The TGT and the ID of the requested service. #2 Authenticator (which is composed of the client ID and the timestamp), encrypted using the Client/TGS Session Key
what is kerberos A. authentication B. encryption C. one way hash D. data security
answer: A. Authentication
what is PKI
answer:
Public key infrastructure (PKI) is a catch-all term for everything used to establish and manage public key encryption, one of the most common forms of internet encryption
what does kerberos try to solve
It is primarily focused on verifying the identity of the users over an insecure network connection. It is symmetric authentication
what service does kerberos use to verify the identity of users
- Kerberos protocol uses KDC (key distribution center) to verify the identity of a certain user over an insecure network.
3 basic steps a client takes during authentication with kerberos
- a client (generally either a user or a service) sends a request for a ticket granting ticket to the Key Distribution Center (KDC) sending a plaintext user ID
- KDC creates a ticket-granting ticket (TGT) for the client, encrypts it using the client’s password as the key
- sends the encrypted TGT back to the client.
the 3 primary pieces (functions) of kerberos are
- A ticket-granting server (TGS) that connects the user with the service server (SS)
- A Kerberos database that stores the password and identification of all verified users
- An authentication server (AS) that performs the initial authentication
what did MS user prior to kerberos
NTLM (NT Lan Manager)
authentication protocols (3) supported by MS AD
Microsoft Active Directory supports
.. Rivest Cipher 4 (RC4)
.. Advanced Encryption Standard 128-bit (AES-128)
.. Advanced Encryption Standard 256-bit (AES-256)
..Data Encryption Standard (DES) encryption
what is a cipher
a cipher is an algorithm for encrypting and decrypting data
is LDAP encrypted
by default LDAP communications between client and server applications are not encrypted
LDAPS is what
light weight Directory Protocol over TLS
Which of the following has the correct term-to-definition mapping?
i. Brute-force attacks: Performed with tools that cycle through many possible character, number, and symbol combinations to uncover a password.
ii. Dictionary attacks: Files of thousands of words are compared to the user’s password until a match is found.
iii. Social engineering: An attacker falsely convinces an individual that she has the necessary authorization to access specific resources.
iv. Rainbow table: An attacker uses a table that contains all possible passwords already in a hash format.
A. i, ii
B. i, ii, iv
C. i, ii, iii, iv
D. i, ii, iii
answer is C:
The list has all the correct term-to-definition mappings.
what are the 7 security controls - not security categories
- Preventive
- Compensating
- Corrective
- Deterrent
- Detective
- Directive
- Recovery
there are 7 security controls. what are the 3 primary
this is not a question about the 3 security categories
- preventative
- detective
- corrective
what are TTPs
- Tactics
- Techniquest
- Procedures
** describe the behaviors, processes, actions, and strategies used by a threat actor to develop threats and engage in cyberattacks **
kerberos attributes snippet
- uses udp port 88
- uses symmetric keys and requires a trusted 3rd party
- K5 use symmetric AES 256
- provides confidentiality and integrity
- using end to end security
- CAN use PKI during CERTAIN phases of the authentication (private public keys)
- if bad actor gets access to KDC they have access to everything with a single password
OAuth 2.0 attributes
- rfc 6749 describes OAuth 2.0
- OAuth shares password information securely with third party applications
- exchanges information using API
- an app obtains an access token from an identity provider
- later, the app includes the access token for authorization
- often used in web applications
- OpenID connect adds authentication functions to OAuth that only does authorization
- in OIDC the user is presented an option of identity providers (IdPs)
- OIDC adds SSO type functionality to OAuth
TCB access, capabilites table, ACL, Mandatory, Discretionary
image below
reference monitor concept
image below
access control matrix, capabilities, ACL diagram
image below
TCB access control
Why is OpenID Connect important?
- Identity is the key to any cloud strategy. At the core of modern authorization is OAuth 2.0, but OAuth 2.0 lacks an authentication component. Implementing OpenID Connect on top of OAuth 2.0 completes an IAM strategy. As more and more companies need to interoperate and more identities are being populated on the internet the demand to be able to re-use these identities will also increase thus, to serve the demand of digital customers it is crucial that identity and authentication be a part of your strategy not only authorization.
SAML attributes and roles
- is an oasis standard 2005
- xml based
- provides authentication and authorization and attribute information on principal
