Domain 5 - Identity and Access Management Flashcards
ACCESS
is flow of information between a subject and an object
CONTROL
security features that control how users and systems communicate and interact with other systems and resources Subject - active entity that requests access to an object or data within the object (user, program)
Subject
active entity that requests access to an object or data within the object (user, program)
Object
is a passive entity that contains information (computer, database, file, program) access control techniques support the access control models
Approaches to Administration
Centralized administration
Decentralized administration
Hybrid
Centralized administration
one element responsible for configuring access controls. Only modified through central administration, very strict control
Decentralized administration
access to information is controlled by owners or creators of information, may not be consistency with regards to procedures, difficult to form system wide view of all user access at any given time
Hybrid
centralized control is exercised for some information and decentralized for other information
Identity Management: What 4 key principles does access control relies on?
IAAA Identification Authentication Authorization Accountability
Identification/Assertion
- Registration
– verify an individual’s identity and adds a unique identifier to an identity system
- ensuring that a subject is who he says he is
- bind a user to the appropriate controls based on the unique user instance
- Unique user name, account number etc. OR an issuance (keycard)
Authentication
- Process of Verifying the user
- User provides private data
- Establish trust between the user and the system for the allocation of privileges
Authorization
- resources user is allowed to access must be defined and monitored
- First piece of credentials Authorization
Accountability
who was responsible for an action?
- Logging – best way to provide accountability, change log for approved changes and change management process
What is the Relationship between Identity, Authentication, and Authorization?
- Identification provides uniqueness
- Authentication provides validity
- Authorization provides control
Logical Access Controls: tools used for IAAA
MAC Address – 48 bit number, supposed to be globally unique, but now can be changed by software, not a strong ID or auth. Tool
Single Sign On (SSO)
SSO referred to as reduced sign-on or federated ID management
Advantage - ability to use stronger passwords, easier administration, less time to access resources.
Disadvantage - once a key is compromised all resources can be accessed, if Db compromised all PWs compromised Thin client is also a single sign on approach
What areas of access control does KERBEROS address?
Kerberos addresses Confidentiality and integrity and authentication, not availability, can be combined with other SSO solutions Kerberos Is based on symmetric key cryptology (and is not a propriety control)
What type of cryptography is KERBEROS base on?
symmetric key cryptography
What are some benefits of KERBEROS?
inexpensive, loads of OS’s, mature protocol
What are some Disadvantage of KERBEROS?
takes time to administer, can be bottleneck or single point of failure
In KERBEROS, what is a Realm?
Indicates an authentication administrative domain. Its intention is to establish the boundaries within which an authentication server has the authority to authenticate a user, host or service.
KDC
Key Distribution Center, grants tickets to client for specific servers. Knows all secret keys of all clients and servers from the network, TGS and AS, single point of failure
AS
Authentication server
TGS
Ticket granting server
Discuss the Kerberos logon process.
- The user types a username and password into the client.
- The client encrypts the username with AES for trans. to the KDC.
- The KDC verifies the username against a database of known credentials.
- The KDC generates a symmetric key that will be used by the client and the Kerberos server. It encrypts this with a hash of the user’s password. The KDC also generates an encrypted timestamped TGT. The KDC then transmits the encrypted symmetric key and the encrypted time-stamped TGT to the client.
- The client installs the TGT for use until it expires. The client also decrypts the symmetric key using a hash of the user’s password. - Then the user can use this ticket to service to use the service as an application service
SESAME
- Public Key Cryptology
- European
- Needham-Schroeder protocol
Two tickets:
- One authentication, like Kerberos
- Other defines the access privileges a user has
- Works with PACS (Privileged Attribute Certificates)
- sesame uses both symmetric as asymmetric encryption (thus improvement upon Kerberos)
What is a weakness with SESAME?
only authenticates the first block and not the complete message
KRYPTOKNIGHT
IBM – thus RACF
SCRIPTING
scripts contain logon information that auths. users
DIRECTORY SERVICE
a centralized database that includes information about subjects and objects, .
Hierarchical naming schema, active directory has sophisticated security resources (group policy, user rights accounts, DNS services)
Categories of authentication factors: Type 1
authentication factor is something you know. Examples include a password, PIN, or passphrase.
Categories of authentication factors: Type 2
authentication factor is something you have. Physical devices that a user possesses can help them provide authentication. Examples include a smartcard (CAC), hardware token, smartcard, memory card, or USB drive.
Categories of authentication factors: Type 3
authentication factor is something you are or something you do. It is a physical characteristic of a person identified with different types of biometrics.
Something a user knows TYPE 1
PASSWORDS cheap and commonly used password generators user chooses own (do triviality and policy checking)
Longer PW more effective than all else PWs never stored for web applications in a well-designed environment.
Salted hashes are stored and compared 62 choices (upper, lower, 10 numbers), add single character to PW and complexity goes up 62X
One-time password aka dynamic password
used only once
Static password
Same for each logon
Passphrase
easiest to remember. Converted to a virtual password by the system.
Cognitive password
easy to remember like your mother’s maiden name
brute force attack
try many different characters aka exhaustive
dictionary attack
try many different words
Social engineering
convince an individual to give access
Rainbow Tables
tables with passwords that are already in hash format, pre-hashed PW paired with high-speed look up functions
Implementation Attack
This is a type of attack that exploits weaknesses in the implementation of a cryptography system. It focuses on exploiting the software code, not just errors and flaws but the methodology employed to program the encryption system
Statistical Attack
exploits statistical weaknesses in a cryptosystem, such as floating-point errors and inability to produce truly random numbers. Statistical attacks attempt to find a vulnerability in the hardware or operating system hosting the cryptography application.
