Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 5: Identity and Access Management > Flashcards

Domain 5: Identity and Access Management Flashcards

1
Q

Access

A

Access is a flow of information between a subject and an object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Subject

A

A subject is an active entity that requests access to an object, which is a passive entity.

A subject can be a user, program, or process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Security mechanisms that provide confidentiality

A
  • Encryption
  • Logical and physical access control
  • Transmission protocols
  • Database views
  • Controlled traffic flow
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

IdM examples

A
  • Directories
  • Web access management
  • Password management
  • Legacy single sign-on
  • Account management
  • Profile update
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Password synchronization

A

Password synchronization reduces the complexity of keeping up with different passwords for different systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Self-service password reset

A

Self-service password reset reduces help-desk call volumes by allowing users to reset their own passwords.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Assisted password reset

A

Assisted password reset reduces the resolution process for password issues for the help-desk department.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What do IdM directories contain?

A
  • All resource information
  • Users’ attributes
  • Authorization profiles
  • Roles
  • Access control policies

They are the one centralized resource from which IdM applications gather this information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

User provisioning

A

User provisioning refers to the creation, maintenance, and deactivation of user objects and attributes as they exist in one or more systems, directories, or applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

User access reviews

A

User access reviews ensure there are no active accounts that are no longer needed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the authoritative source for user identities?

A

The HR database is usually considered the authoritative source for user identities because that is where each user’s identity is first developed and properly maintained.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Access control models (list 5)

A
  • Discretionary
  • Mandatory
  • Role based
  • Rule based
  • Attribute based
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

DAC

A

Discretionary access control (DAC) enables data owners to dictate what subjects have access to the files and resources they own.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

MAC

A

The mandatory access control (MAC) model uses a security label system. Users have clearances, and resources have security labels that contain data classifications.

MAC systems compare these two attributes to determine access control capabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

RBAC

A

Role-based access control (RBAC) is based on the user’s role and responsibilities (tasks) within the company.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

RB-RBAC

A

Rule-based RBAC (RB-RBAC) builds on RBAC by adding Boolean logic in the form of rules or policies that further restrict access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

ABAC

A

Attribute-based access control (ABAC) is based on attributes of any component of the system. It is the most granular of the access control models.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Constrained user interface measurements (list 3)

A
  • Menus and shells
  • Database views
  • Physically constrained interfaces
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How is an access control list used?

A

Access control lists are bound to objects and indicate what subjects can use them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Capability table

A

A capability table is bound to a subject and lists what objects it can access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Remote access control technology examples (list 3)

A
  • RADIUS
  • TACACS+
  • Diameter
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Administrative control examples (list 5)

A
  • Security policy
  • Personnel controls
  • Supervisory structure
  • Security awareness training
  • Testing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Physical control examples (list 5)

A
  • Network segregation
  • Perimeter security
  • Computer controls
  • Work area separation
  • Cable
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Technical control examples (list 6)

A
  • System access
  • Network architecture
  • Network access
  • Encryption
  • Protocols
  • Auditing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does it take for a subject to be able to access a resource?

A

For a subject to be able to access a resource, it must be:

  • Identified
  • Authenticated
  • Authorized
  • Held accountable for its actions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

How can authentication be accomplished? (list 6)

A
  • Biometrics
  • Password
  • Passphrase
  • Cognitive password
  • One-time password
  • Token
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Type I and Type II biometric errors

A
  • Type I error means the system rejected an authorized individual
  • Type II error means an imposter was authenticated
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Memory card vs. Smart card

A

A memory card cannot process information, but a smart card can through the use of integrated circuits and processors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Least-privilege and need-to-know

A

Least-privilege and need-to-know principles limit users’ rights to only what is needed to perform tasks of their job.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Single sign-on (list 3 ways to accomplish)

A
  • Kerberos
  • Domains
  • Thin clients
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

How does Kerberos work?

A
  • The Kerberos user receives a ticket granting ticket (TGT)
  • The TGT allows him to request access to resources through the ticket granting service (TGS)
  • The TGS generates a new ticket with the session keys
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Keystroke monitoring

A

Keystroke monitoring is a type of auditing that tracks each keystroke made by a user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Object reuse

A

Object reuse can unintentionally disclose information by assigning media to a subject before it is properly erased.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

When is deleting not enough?

A

Just removing pointers to files (deleting file, formatting hard drive) is not always enough protection for proper object reuse.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

How to prevent data leakage via electrical signals in airwaves

A
  • TEMPEST
  • White noise
  • Control zones
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

How is user authentication accomplished?

A
  • By what someone knows
  • By what someone is
  • By what someone has
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Password-generating token methods

A
  • Synchronous (time, event)
  • Asynchronous (challenge-based)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What makes strong authentication?

A

Strong authentication requires two of the three user authentication attributes:

  • What someone knows
  • What someone is
  • What someone has
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Kerberos weaknesses

A
  • The KDC is a single point of failure
  • It is susceptible to password guessing
  • Session and secret keys are locally stored
  • KDC needs to always be available
  • There must be management of secret keys
40
Q

Phishing

A

Phishing is a type of social engineering with the goal of obtaining personal information, credentials, credit card numbers, or financial data.

41
Q

Race condition

A

A race condition is possible when two or more processes use a shared resource and the access steps could take place out of sequence.

42
Q

Mutual authentication

A

Mutual authentication is when two entities must authenticate to each other before sending data back and forth. Also referred to as two-way authentication.

43
Q

Directory service

A

A directory service is a software component that stores, organizes, and provides access to resources, which are listed in a directory (listing) of resources.

Individual resources are assigned names within a namespace.

44
Q

Cookie

A

A cookie is data that is held permanently on a hard drive in the format of a text file or held temporarily in memory.

It can be used to store browsing habits, authentication data, or protocol state information.

45
Q

Federated identity

A

A federated identity is a portable identity, and its associated entitlements, that can be used across business boundaries without the need to synchronize or consolidate directory information.

46
Q

XML

A

Extensible Markup Language (XML) is a set of rules for encoding documents in machine-readable form to allow for interoperability between various web-based technologies.

47
Q

SPML

A

Service Provisioning Markup Language (SPML) is an XML-based framework being developed by OASIS for exchanging user, resource, and service provisioning information between cooperating organizations.

48
Q

XACML

A

Extensible Access Control Markup Language (XACML), which is both a declarative access control policy language implemented in XML and a processing model, describes how to interpret security policies.

49
Q

Replay attack

A

Replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated with the goal of obtaining unauthorized access.

50
Q

Clipping level

A

Clipping level is a threshold value.

Once a threshold value is passed, the activity is considered to be an event that is logged, investigated, or both.

51
Q

Rainbow table

A

A rainbow table is a set of precomputed hash values that represents password combinations.

Rainbow tables are used in password attack processes and usually produce results more quickly than dictionary or brute-force attacks.

52
Q

Cognitive passwords

A

Cognitive passwords are fact-or opinion-based information used to verify an individual’s identity.

53
Q

Smart card types (List 2)

A

Smart cards can:

  • Require physical interaction with a reader (contact)
  • Require no physical interaction with the reader (contactless architectures)

Two contactless architectures are:

  • Combi (one chip)
  • Hybrid (two chips)
54
Q

Side channel attack

A

A side channel attack is carried out by:

  • Gathering data pertaining to how something works
  • Using that data to attack it or crack it

Examples:

  • Differential power analysis
  • Electromagnetic analysis
55
Q

Authorization creep

A

Authorization creep takes place when a user gains too much access rights and permissions over time.

56
Q

SIEM

A

Security information and event management (SIEM) implements data mining and analysis functionality to be carried out on centralized logs for situational awareness capabilities.

57
Q

Intrusion detection

A

Intrusion detection systems are either:

  • Host based
  • Network based

They provide either:

  • Behavioral (statistical) functionality
  • Signature (knowledge) functionality
58
Q

Phishing variants

A
  • Spear-phishing:
    • Crafted for a specific individual
  • Pharming:
    • DNS server is poisoned and points users to a malicious website
59
Q

Web portal

A

A web portal is commonly made up of portlets, which are pluggable user interface software components that present information and services from other systems.

60
Q

SPML

A

The Service Provisioning Markup Language (SPML) allows for:

  • Automation of user management
    • Account creation
    • Amendments
    • Revocation
  • Access entitlement configuration
    • Related to electronically published services across multiple provisioning systems.
61
Q

SAML

A

The Security Assertion Markup Language (SAML) allows for the exchange of authentication and authorization data to be shared between security domains.

62
Q

OpenID

A

OpenID is an open standard and protocol that allows third-party authentication of a user.

63
Q

OAuth

A

OAuth is an open standard that allows a user to grant authority to some web resource, like a contacts database, to a third party.

64
Q

OpenID Connect

A

OpenID Connect is an authentication layer built on the OAuth 2.0 protocol that allows transparent authentication and authorization of client resource requests.

65
Q

SOAP

A

The Simple Object Access Protocol (SOAP) is a protocol specification for exchanging structured information in the implementation of web services and networked environments.

66
Q

SOA

A

Service-oriented architecture (SOA) environments allow for a suite of interoperable services to be used within multiple, separate systems from several business domains.

67
Q

RFID

A

Radio-frequency identification (RFID) is a technology that provides data communication through the use of radio waves.

68
Q

What is a dictionary attack against passwords and how does it work?

A

A dictionary attack is fed lists, or dictionaries, of commonly used words or combinations of characters, which it then compares against the unknown credentials to identify any matches and guess the passwords.

69
Q

What is a rainbow table and how does it work?

A

A rainbow table seeks to mitigate the limitations of dictionary or brute force attacks by precomputing every possible combination of characters in varying password lengths, and storing the hash in an indexed table. Dictionary and brute force password attacks are only marginally successful in breaking passwords. A rainbow table seeks to mitigate this by precomputing every possible combination of characters in varying password lengths and storing the hash in an indexed table. These rainbow tables can be quite large, but they reduce password cracking time by a considerable amount and, in some cases, crack passwords where other methods have failed.

70
Q

What model implements access control matrices to control how subjects interact with objects when comparing the available models?

A

Discretionary access control (DAC) model is implemented and enforced through the use of access control lists (ACLs), which are held in a matrix.

MAC is implemented and enforced through the use of security labels.

71
Q

What are two potential attacks that can be conducted against a Kerberos authentication scheme?

A
  • Confidentiality
  • Availability

In confidentiality attacks, the tickets used by Kerberos, which are authentication tokens, can be sniffed and potentially cracked.

In availability attacks, if an attacker targets the Kerberos KDC server, it can prevent anyone in the realm from logging in. If the KDC is brought down, no entities could communicate to each other through networking methods.

72
Q

What are two common methods used to crack passwords?

A
  • Dictionary
  • Brute force attacks

A dictionary attack runs through a predefined database of passwords, or possibly an actual dictionary, to determine if any of the words from the database are the correct password.

Brute force attacks run through literally every possible character combination one at a time until the password is successfully guessed. Dictionary and brute force attacks can be combined into a hybrid attack.

73
Q

Authentication can be based on three factors, or a combination of two or more of the three. What are the authentication factors?

A
  • Something you know
  • Something you have
  • Something you are

Something you know includes passwords and PINs. Both of these are susceptible to loss and social engineering.

Something you have includes tokens or smartcards. These can be duplicated or the user can be social engineered to give an attacker the object.

Something you are includes any form of biometrics. Common examples include fingerprint, iris print, and voice print. These items are susceptible to failure and, in some cases, duplication.

74
Q

Describe issues network IDSs have in switched environments.

A

NIDSs have a harder time working on a switched network, compared to traditional nonswitched environments, because data is transferred through independent virtual circuits and not broadcasted, as in nonswitched environments.

The IDS sensor acts as a sniffer and does not have access to all the traffic in these individual circuits. So we have to take all the data on each individual virtual private connection, make a copy of it, and put the copies of the data on one port (spanning port) where the sensor is located. This allows the sensor to have access to all the data going back and forth on a switched network.

75
Q

What are the two components of the KDC?

A
  • Authentication service
  • Ticket-granting service

Authentication service issues ticket-granting tickets (TGT) that are good for admission to the ticket-granting service (TGS).

Before network clients can get tickets for services, they must obtain a TGT from the authentication service.With ticket-granting service, clients receive tickets to specific target services. These tickets are used to authenticate to server services.

76
Q

What are intrusion detection system (IDS) host-based versus network-based approaches?

A

A network-based IDS monitors network communications. It cannot “see” activity going on inside the computer itself.

A host-based IDS monitors activity within a particular computer system. It is installed on individual workstations and/or servers and watches for anomalous activity.

An intrusion detection system (IDS) is a system or device designed to detect a security breach. IDSs come in two main types: network-based, which monitor network communications, and host-based, which can analyze the activity within a particular computer system.

A network IDS (NIDS) monitors network traffic and cannot “see” the activity going on inside a computer itself. To monitor the activities within a computer system, a company would need to implement a host-based IDS.

A host-based IDS (HIDS) can be installed on individual workstations and/or servers and watch for inappropriate or anomalous activity. HIDSs are usually used to make sure users do not delete system files, reconfigure important settings, or put the system at risk in any other way. So, whereas the NIDS understands and monitors the network traffic, a HIDS’s universe is limited to the computer itself. A HIDS does not understand or review network traffic, and a NIDS does not “look in” and monitor a system’s activity.

77
Q

How is an intrusion prevention system (IPS) different from an intrusion detection system (IDS)?

A

Only the intrusion prevention system (IPS) is capable of taking preventive or proactive action to halt suspicious activity.

Whereas an intrusion prevention system (IPS) is capable of taking preventive or proactive action to halt suspicious activity, an IDS simply identifies suspicious activity and issues an alert to notify administrators or IT personnel.

The traditional IDS only detects that something bad may be taking place and sends an alert. The goal of an IPS is to detect this activity and not allow the traffic to gain access to the target in the first place.

78
Q

A common method to provide centralized access control is RADIUS. What are the five RADIUS steps?

A
  • The user connects to the RADIUS client.
  • The RADIUS client requests credentials from the user.
  • The user enters credentials.
  • The RADIUS client encrypts the credentials and passes them to the RADIUS server.
  • The RADIUS server accepts, rejects, or challenges the credentials.
79
Q

What is SESAME?

A

The Secure European System for Applications in a Multi-vendor Environment (SESAME) project is a single sign-on technology developed to extend Kerberos functionality and improve upon its weaknesses.

SESAME uses symmetric and asymmetric cryptographic techniques to authenticate subjects to network resources. One of these certificates provides authentication, as in Kerberos, and the second certificate controls the access privileges assigned to a client.

80
Q

What is an access control?

A

An access control is a security feature that controls how users and systems communicate and interact with other systems and resources.

Access controls protect the systems and resources from unauthorized access and can be components that can help determine the level of authorization after authentication has been successfully completed.

81
Q

What is emanation security and what is the threat that is involved?

A

Electrical devices emit emanations (signals) that if captured and interpreted properly can result in confidential data being disclosed.

There are two types of emanations:

  • Radiated (through the air)
  • Conducted (through wires)

TEMPEST started out as a study carried out by the DoD and then turned into a standard that outlines how to develop countermeasures that control spurious electrical signals emitted by electrical equipment.

82
Q

What are characteristics of a decentralized or distributed access control methodology?

A
  • Gives control to individuals closer to resources, such as department managers and occasionally users.
  • Does not use one centralized entity to process access requests.
  • Peer-to-peer in design lacks standardization and overlapping rights, and might include security holes because of this lack of standardization
83
Q

What are some typical biometric types that uniquely authenticate an individual’s identity?

A
  • Fingerprints
  • Retina patterns
  • Iris patterns
  • Facial characteristics
  • Palm patterns
  • Hand geometry
  • Voice print
  • Signature dynamics
84
Q

What are two basic access control models used in organizational access control methodologies?

A
  • Centralized access control
  • Decentralized access control

Centralized access control has one entity or department that is responsible for overseeing access to all corporate resources.

Decentralized access control shares or delegates responsibility for overseeing access to different departments, sites, or entities within the organization.

85
Q

List three types of anomaly-based IDS approaches.

A
  • Statistical anomaly–based
  • Protocol anomaly–based
  • Traffic anomaly–based

The statistical anomaly–based approach creates a profile of “normal” and compares activities to this profile.

The protocol anomaly–based approach identifies protocols used outside of their common bounds.

The traffic anomaly–based approach identifies unusual activity in network traffic.

Anomaly-based IDS is also called behavior or heuristic-based.

86
Q

The process of mutual authentication involves what main steps?

A

A user authenticates to a system and the system authenticates to the user.

Mutual authentication means it is happening in both directions.

87
Q

What are the three control categories, which also encompass access controls?

A
  • Administrative controls
  • Physical controls
  • Technical controls

Administrative controls include things such as policies and procedures and training.

Physical controls are things such as doors, locks, or surveillance cameras.

Technical controls are things such as software tools used to restrict access to objects.

88
Q

What are the methods to defend against emanation leakage?

A
  • TEMPEST
  • White noise
  • Control zones

TEMPEST is special shielding used on equipment to suppress the signals as they emanate from devices. TEMPEST equipment is implemented to prevent intruders from picking up information through the airwaves or cables with listening devices.

White noise uses special devices that send out a stream of frequencies that make it impossible for an attacker to distinguish the real information.

Control zones are the practice of designing facilities, walls, floors, ceilings and transmission/power wires to block or filter emanated signals from leaving the zone.

89
Q

What are the three models for access controls?

A

Mandatory

Discretionary

Nondiscretionary

In the mandatory model, the authorization of an entity’s access to an object is dependent upon labels, which indicate the subject’s clearance, and the classification or sensitivity of the object.

In the discretionary model, the entity has authority, within certain limitations, to specify what objects can be accessible to subjects.

In the nondiscretionary model, a central authority determines what entities can have access to certain objects based on the organizational security policy. The access controls might be based on the individual’s role in the organization (role-based) or the subject’s responsibilities and duties (task-based).

90
Q

Provide characteristics of a rule-based IDS.

A
  • Use of if/then rule-based programming within expert systems
  • Use of an expert system allows for artificial intelligence characteristics
  • The more complex the rules, the more demands on software and hardware processing requirements
  • Cannot detect new attacks
91
Q

What is RADIUS?

A

Remote Authentication and Dial-In User Service (RADIUS)

  • RADIUS provides three services:
  • Authentication
  • Authorization
  • Accounting (Auditing)

It facilitates centralized user administration and keeps all user profiles in one location that all remote services share.

92
Q

Using a passphrase is a more secure method of authentication than a password. What is a passphrase?

A

A passphrase is a sequence of characters that is longer than a password.

A passphrase is generally a sentence, or phrase, as opposed to a single word.

For example, rather than using a password such as “country,” you could use a passphrase such as “asknotwhatyourcountrycandoforyou.” Combined with transposition of alternate and special characters (for example, “askn0twhatyourcountryc@ndo4U”), the passphrase can be significantly more secure than a password.

You can also use the passphrase to generate a more complex password that is easier to remember. By taking just the first letter of each word from the passphrase, you can create “anwyccdfy,” which would be difficult to guess or crack.

93
Q

What are the three main performance measures in biometrics?

A
  • False Rejection Rate (FRR)
    • Type I error
  • False Acceptance Rate (FAR)
    • Type II error
  • Crossover Error Rate (CER)

The false rejection rate (FRR) or Type I error is the percentage of valid subjects that are falsely rejected.

The false acceptance rate (FAR) or Type II error is the percentage of invalid subjects that are falsely accepted.

The crossover error rate (CER) is a measure of the overall accuracy of a biometric system. CER is the point at which the FRR is equal to the FAR. The lower the CER, the more accurate the biometric system is.

94
Q

What is user provisioning when dealing with access control in an organization?

A

User provisioning refers to the creation, maintenance, and deactivation of user objects and attributes, as they exist in one or more systems, directories, or applications.

95
Q

One approach to minimize the complexity of authentication is single sign-on (SSO). What is single sign-on?

A

A single sign-on (SSO) system enables a user to authenticate one time and then access resources in the environment without needing to reauthenticate each time.

SSO alleviates the problem of users having to remember multiple usernames and password credentials and having to repeatedly authenticate.

  • Kerberos
  • SESAME
  • KryptoKnight (by IBM)
  • NetSP (a KryptoKnight derivative)

are authentication server systems with operational modes that can implement single sign-on.

96
Q

One method to control access is to implement a clipping level. What is a clipping level as it relates to access control?

A

A clipping level is when an administrator establishes a threshold that allows a certain number of failed login attempts before an account is simply locked out.

This type of access control prevents an attacker from continuing to attempt different combinations of credentials to gain unauthorized access.

97
Q

What are two basic types of IDS/IPS?

A
  • Signature-based systems
  • Anomaly-based systems

Signature-based systems compare monitored network traffic against a database of known threats or suspicious behaviors to look for pattern or signature matches that indicate a potential attack.

Anomaly-based systems compare current monitored network traffic against a baseline or known-good network traffic pattern and identify anomalous patterns that might indicate suspicious activity.

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions