Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

TDK-CISSP > Domain 5 - Identity and Access Management > Flashcards

Domain 5 - Identity and Access Management Flashcards

1
Q

Information

A

Includes all of the organizations data. Needs to be protected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Systems

A

Includes any and all IT systems that provide a service (File, Web)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Facilities

A

Any Physical location that an org rents/owns. Physical security protects the building

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Subject

A

A subject is an active entity that accesses a passive object to receive information from an object. When authorized, subjects can modify objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Object

A

An object is a passive entity that provides information to active subjects. Includes files, DB’s, computers, programs, processes etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Access Control

A

Access Control is any hardware, software or administrative policy that controls access to the resources. The goal is to prevent unauthorized access and provide authorized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Access Control Steps

A
  1. ) Identify and authenticate users
  2. ) Determine if access is authorized
  3. ) Grant or restrict access based on the subject’s identity
  4. ) Monitor and record access attempts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Preventive Access Control

A

A preventive control attempts to stop unwanted or unauthorized activity from occurring.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Detective Access Control

A

A detective control attempts to discover or detect unwanted or unauthorized activity. Detective controls operate after the fact and can discover the activity only after it has occurred

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Corrective Access Control

A

A corrective control modifies the environment to return systems to normal after an unwanted or unauthorized activity has occurred.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Deterrent Access Control

A

A deterrent control attempts to discourage security policy violations. Depends on People

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Directive Access Control

A

A directive control attempts to direct, confine, or control the actions of subjects to force or encourage compliance with security policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Compensation Access Control

A

A compensation control provides an alternative when
it isn’t possible to use a primary control, or when necessary to increase the effectiveness
of a primary control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Administrative Access Control

A

Administrative access controls are the policies and
procedures defined by an organization’s security policy and other regulations or
requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Logical/Technical Access Control

A

Logical access controls (also known as technical access controls) are the hardware or software mechanisms used to manage access and to provide
protection for resources and systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Physical Controls

A

Physical access controls are items you can physically touch. They include physical mechanisms deployed to prevent, monitor, or detect direct contact with
systems or areas within a facility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Confidentiality

A

Access controls help ensure that only authorized subjects can access objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Integrity

A

Integrity ensures that data or system configurations are not modified without authorization, or if unauthorized changes occur, security controls detect the changes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Availability

A

Authorized requests for objects must be granted to subjects within a reasonable amount of time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Identification

A

The process of a subject claiming or professing an identity. A subject must provide an identity to a system to start the AAA process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Authentication

A

Verifies the identity of the account by comparing it against a DB of valid identities. Authentication Info needs to be protected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Authorization

A

Subjects are granted access to objects based on proven identities. Authorization indicates who is trusted to perform specific operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Accountability

A

Users and other subjects can be held accountable for their actions when auditing is implemented. Auditing tracks subjects and records when they access objects, creating an audit trail in one or more audit logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Auditing

A

Auditing is the process of tracking and recording

subject activities within logs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Type 1

A

Something you know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Type 2

A

Something you have

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Type3

A

Something you are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Tokens

A

Password generating device.

  1. ) Synchronous Dynamic Password Tokens
  2. )Asynchronous Dynamic Password Tokens
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Biometric Type 1 Error

A

When a valid subject is not authenticated. False negative Authentication. False Rejection rate (FRR)

30
Q

Biometric Type 2 Error

A

When an valid subject is authenticated. False Positive Authentication. False Acceptance Rate (FAR)

31
Q

Crossover Error Rate (CER)

A

The point where FAR and FRR % are equal

32
Q

Identity Management Types

A
  1. ) Centralized - Single entity

2. ) Decentralized - Various entities through out the system

33
Q

Single Sign-On (SSO)

A

Is a centralized access control technique that enables a subject to authenticated once on a system and access multiple resources without authenticating again

34
Q

Ticket Authentication

A

A mechanism that employs a third party entity to prove identification and provide authentication. Example: Kerberos

35
Q

Key Distribution Center (KDC)

A

The key distribution center (KDC) is the trusted third party that provides authentication services. Kerberos uses symmetric-key cryptography to authenticate clients to servers. All clients and servers are registered with the KDC, and it maintains the secret keys for all network members.

36
Q

Kerberos Authentication Server

A

The authentication server hosts the functions of
the KDC: a ticket-granting service (TGS), and an authentication service. The authentication service verifies or rejects the authenticity and timeliness of tickets. This server is often called the KDC.

37
Q

Ticket-Granting Ticket

A

ticket-granting ticket (TGT) provides proof that a subject has authenticated through a KDC and is authorized to request tickets to access other
objects.

A TGT is encrypted and includes a symmetric key, an expiration time, and the user’s IP address. Subjects present the TGT when requesting tickets to access objects.

38
Q

Ticket

A

A ticket is an encrypted message that provides proof that a subject is authorized to access an object. It is sometimes called a service ticket (ST).

39
Q

Identity Management

A

Is the management of user identities and their credentials

40
Q

SAML

A

Security Assertion Markup Language. An XML based language that is used to exchange AA info between federated organizations

41
Q

SPML

A

Security Provisioning Markup Language. Newer version of XML. Specifically designed for exchanging user information for federated SSO. Based on DSML

42
Q

Scripted Access

A

Establish Communication links by providing an automated process to transmit logon credentials at the start of a logon session

43
Q

SESAME

A

To address weaknesses in KERBEROS

44
Q

KryptoKnight

A

Ticket-based - IBM. User P2P instead of third party

45
Q

Newer SSO models

A

OAuth and OpenID. OAuth 2.0 is not backwards compatible. OpenID foundation looks after OpenID not IETF

46
Q

RADIUS

A

Centralizes authentication for remote connections. Typically used when the org has more than one network access server. Provides AAA. UDP. RFC2865

47
Q

Identity and Access Provisioning Life Cycle

A
  1. ) Provisioning - Enrollment
  2. ) Account Review - Excessive and Creeping Privileges
  3. ) Account Termination - ASAP
48
Q

Permissions

A

Access granted for an object and determine what you can do with it

49
Q

Rights

A

Refer to the ability to take action on an object

50
Q

Privileges

A

Combination of Rights and Permissions

51
Q

Authorization Mechanisms

A
  1. ) implicit Deny
  2. ) Access Control Matrix
  3. ) Capability Matrix
  4. ) Constrained Interface
  5. ) Content Dependent Control
  6. ) Context Dependent Control
  7. ) Need to Know
  8. ) Lease Privilege
52
Q

Constrained Interface

A

Application use these to restrict what the user can see or do based on their privileges

53
Q

Context-Dependent Control

A

Require a specific activity before granting a user access. E-Commerce apps. Pay before you download

54
Q

Need to Know

A

Subjects are granted access only to what they need to know for their tasks. Subjects may have clearence but are not granted authorization to data unless they need to perform an action

55
Q

Least Privilege

A

Similar to Need to Know but it also includes rights to take action on an system

56
Q

Security Policy

A

A document that defines the security requirements of the organization. It identifies the assets that need protection and the extent to which it needs to be protected by the Security Solution.

57
Q

Discretionary Access Control (DAC)

A

Allows the owner, creator, or data custodian of an object to control and define access to that object. All objects have owners, and access control is based on the discretion or decision of the owner.

Implemented using ACL’s

58
Q

Role Based Access Control (RBAC)

A

Defines the subject’s ability to access an object based on the subject’s role or assigned tasks.

Implemented using Groups

59
Q

Privilege Creep

A

Is the tendency for the privileges to accrue for the users over time as their roles and access needs change.

60
Q

Rule Based Access Control (RuBAC)

A

Uses a set of rules, restriction or filters to determine what can and/or cannot occur on a system. Includes Granting the subject access to an object or granting the subject the ability to perform an action

61
Q

Mandatory Access Control (MAC)

A

relies on the use of classification labels. Each
classification label represents a security domain, or a realm of security. A security domain is a collection of subjects and objects that share a common security policy.

62
Q

MAC Features

A
  1. ) Compartmentalization
  2. ) Need to Know
  3. ) Better security than DAC
63
Q

Compartmentalization

A

No relation between one security domain and another. Each domain represents and isolated compartment

64
Q

Steps for Risk Management

A
  1. ) Identifying Assets
  2. ) Identifying Threats
  3. ) Identifying Vulnerabilities
65
Q

Asset Valuation

A

Refers to identifying the actual value of assets with the goal of prioritizing them.

66
Q

Threat modelling

A

Refers to the process of identifying, understanding and categorizing potential threats. The goal is to identify a potential list of threats to systems and analyze the risk

67
Q

SD3+C

A

Secure By design, Secure by default, Secure in Deployment and Communication

68
Q

Threat modelling Approaches

A
  1. ) Asset focused
  2. ) Attacker focused
  3. ) Software focused
69
Q

Vulnerability Analysis

A

Attempts to discover weaknesses in these systems against potential threats

70
Q

Protection Methods

A
  1. ) Control Physical Access to systems
  2. ) Control Electronic access to files
  3. ) Encrypt password files
  4. ) MFA
  5. ) Account Lockout Control
  6. ) Password Masking
  7. ) Use last logon message

TDK-CISSP (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions