Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

- > Domain 5: Identity and Access Management > Flashcards

Domain 5: Identity and Access Management Flashcards

1
Q

What is Access?

A

Flow of information between a subject and an object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an Access Control?

A

It is a security feature that controls how subjects and objects communicate and interact with other systems and resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Object?

A

Passive entity that contains information (computer, database, file, program) that is accessed by a subject.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Centralised administration: Approaches to Administration

A

One element responsible for configuring access controls. Only modified through central administration, very strict control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Decentralised administration: Approaches to Administration

A

Access to information is controlled by owners or creators of information. There may be a lack of consistency with regards to procedures, as it is difficult to form a system wide view of all user access at any given time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Hybrid: Approaches to Administration

A

Centralised control is exercised for some infomation and decentralised for other information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

IAAA

A

Four key principles upon which access control relies:

  1. Identification
  2. Authentication
  3. Authorisation
  4. Accountability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Explain the principle of Identification/Assertion

A

This is about ensuring a subject is who he says he is. It binds a user to the appropriate controls based on the unique user instance. This may also include Registration which is about verifying an individual’s identity and adds a unique idenfier to an identity system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Explain the principle of Authentication

A

Process of verifying the user where the user provides private data and establishes trust between the user and the system for the allocation of privileges.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Explain the principle of Authorisation

A

Checks the resources user is allowed to access. These resources must be defined and monitored.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Explain the principle of Accountability

A

Who was responsible for an action? Logging is the best way to provide accountability, where change log for approved changes and change management process is captured.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Relationship between Identity, Authentication, and Authorisation

A
  • Identification provides uniquness
  • Authentication provides validity
  • Authorsiation provides control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Logical Access Controls

A

Tools used to administer IAAA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

MAC Address

A

48 bit number, supposed to be globally unique, however, can be spoofed by software and no longer acts as a strong ID or authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

SSO

A

Single Sign On. It is also referred to as Reduced Sign On or federated ID management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

SSO Advantages

A

Ability to use stronger passwords, easier administration, and less time to access resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

SSO Disadvantages

A

Once a key is compromised, all resources can be accessed. Similarly, if DB is compromised all PWs are compromised. A thin client is also a SSO approach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Kerberos

A

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using symmetric keys. Additionally, it addresses confidentiality, integrity, and authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Benefits of Kerberos

A

Inexpensive, supported by a number of OS’s and is a mature protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Disadvantages of Kerberos

A

Takes time to administer, can be bottleneck or single point of failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is ‘Realm’?

A

Indicates an authentication administrative domain. Its intention is to establish the boundaries within which an authentication server has the authority to authenticate a user, host, or service. Uses symmetric Key cryptography.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

KDC

A

The Key Distribution Centre grants tickets to client for specific servers. It knows all secret keys of all clients and servers from the network, TGS and AS. However, acts as a single point of failure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

AS

A

Authentication Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

TGS

A

Ticket Granting Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Explain the Kerberos logon process

A
  1. The user types a username and password into the client
  2. The client encrypts the username with AES for transfer to the KDC.
  3. The KDC verifies the username against a database of known credentials.
  4. The KDC generates a symmetric key that will be used by the client and the Kerberos server. It encrypts this with a hash of the user’s password. The KDC also generates an encrypted time stamped TGT to the client.
  5. The client installs the TGT for use until it expires. The client also decrypts the symmetric key using a hash of the user’s password.
  6. Finally, the user can use this ticket to access to the desired service.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

SESAME

A

Is a public key cryptology based authentication protocol. Its weakness is that it only authenticates first block and not the complete message. SESAME uses one ticket for authentication, while the other ticket is used for access privileges. This works with Privileged Attribute Certificates (PACS) and can use both symmetric and asymmetric encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Logon scripting

A

Uses scripts to authenticate users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Directory service

A

A centralised database that includes information about subjects and objects. Hierarchical naming scheme, active directory has sophisticated security resources (group policy, user rights accounts, DNS services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Type 1: Single Factor Authentication

A

Authentication factor is something you know, for example, password, PIN or passphrase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Type 2: Multi Factor Authentication

A

Something you have, such as physical devices that a user can use to provide authentication. Examples include smartcard, hardware token, smartcard, memory card, or USB drive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Type 3: Multi Factor Authentication

A

Something you are, or something you do. It is a physical characteristic of a person identified with different types of biometrics, such as fingerprint or iris scans.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Type 1: Single Factor Authentication Examples

A

Passwords. A user can chose their own password, however, generally a longer password is a safer one.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Salting

A

A unique value is added to the end of the password to create a different hash value. This adds a layer of security to the hashing process, specifically against brute force attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

One Time Passwords

A

Can be one solution to increase security for type 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Passphrase

A

Easiest to remember. This is converted to a virtual password by the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Cognitive password

A

Easy to remember like your mother’s maiden name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Hacking

A

Unauthorised access to password file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Brute force attack

A

Trying many different characters. This is an exhaustive attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Dictionary attack

A

Trying common words in the dictionary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Social Engineering

A

Spoofing your identity to someone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Rainbow tables

A

Tables with passwords that are already in has formt, pre-hashed PW’s paired with high-speed look up functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Implementation attack

A

This is a type of attack that exploits weaknesses in the implementation of a cryptography system. It focuses on exploiting the software code, not just errors and flaws but the methodology employed to program the encryption system.

43
Q

Statistical Attack

A

Exploits statistical weaknesses in a cryptosystem, such as floating point errors and inability to produce truly random numbers. Statistical attacks attempt to find a vulnerability in the hardware or OS hosting the cryptography application.

44
Q

Password checker and password hacker

A

Both programs that can find passwords (checker to see if its compliant, hackers to use it by the hacker).

45
Q

Nonce

A

A number or bit string used only once, in security engineering

46
Q

Type 2: Authentication Examples

A

Such as key, swipe card, access card, badge, and tokens

47
Q

Static Password Token

A

Owner authenticates to token, token authenticates to the information system

48
Q

Synchronous (Time Based) Dynamic

A

Uses time or a counter between the token and the authentication server. Secure ID RSA keys are an example.

49
Q

Asynchronous (Not Time Based) OTP Generation

A

Server sends a nonce (random value). This goes into the token device, encrypts and delivers a OTP, with an added PIN.

50
Q

Challange/response token

A

Generates response on a system/workstation provided challenge; synchronous - timing, asynchronous - challenge.

51
Q

Type 3: Authentication Examples

A

Biometrics, such as fingerprints.

52
Q

Type 1: Biometric Errors

A

False Rejection Rate (FRR)

53
Q

Type 2: Biometric Error

A

False Acceptance Rate (FAR)

54
Q

Crossover Error Rate (CER)

A

Where FRR = FAR. The lower the CER, the more accurate the system.

55
Q

Fingerprint biometric

A

Made up of ridge engings and bifurcations exhibited by the friction ridges and other detailed characteristics that are called minutiae.

56
Q

Retina Scans

A

Scans the blood-vesel pattern of the retina on the backside of the eyeball. Can show medical conditions, however, is the most accurate

57
Q

Iris Scans

A

Scans the coloured portion of the eye that surrounds the pupil

58
Q

Facial Scans

A

Takes attributes and characteristics like bone structure, nose ridges, eye widths, forehead sies, and chin shapes into account.

59
Q

Palm Scans

A

The palm has creases, ridges and grooves throughout it that are unique to a specific person. Appropriate by itself as a Type 3 authenicator.

60
Q

Hand Geometry

A

The shape of a person’s hand (the length and width of the hand and fingers) measures hand geometry.

61
Q

Voice Print

A

Distinguishing the differences in people’s speech sounds and patterns.

62
Q

Signature Dynamics

A

Electrical signals of speed and time that can be captured when a person writes a signature

63
Q

Keyboard Dynamics

A

Captures the electrical signals when a person types a certain phrase

64
Q

Hand Topology

A

Looks at size and width of an individual’s hand and fingers

65
Q

SAML

A

Security Assertion Markup Language is an open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider.

66
Q

SAML 2 and its roles

A

SAML 2 enables web based applications to include SSO. Roles include:

  • Principal (user)
  • Identity Provider (IdP)
  • Service Provider (SP)
67
Q

XML Signature

A

Uses digital signature for authentication and message integrity based on XML signature standard.

68
Q

IDaaS

A

Identity as a Service, is a third party service that provides identity and access managment. Effectively provides SSO for the cloud and is especially useful when internal clients access cloud-based Software as a Service (SaaS) applications. Allows provision of identities held by the service to target applications

69
Q

Cloud Identity

A

Users are created and managed by an online system, such as Office 365

70
Q

Directory Synchronisation

A

Users are created and managed in an on premises identity provider

71
Q

Federated Identity

A

An arrangement that can be made between multiple enterprises to let subscribers use the same identification data to obtain access to the networks of all the enterprises in the group. The use of such a system is sometimes called identity federation.

72
Q

What is an Object

A

Passive entity that provides information to active subjects.

73
Q

What is a Subject

A

Active entity that accesses a passive object

74
Q

Four Main types of access control techniques

A
  1. Discretionary Access Control (DAC)
  2. Mandatory Access Control (MAC)
  3. Role Based Access Control (role BAC)
  4. Rule Based Access Control (rule-BAC)
75
Q

RADIUS

A

Typically used for wireless networks, modems, and network devices.

76
Q

OAuth

A

An open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords.

77
Q

Role BAC

A

Task based access controls define a subject’s ability to access an object based on the subject’s role or assigned tasks, is often implemented using groups, form of nondiscretionary. Types of RBAC include, Hybrid RBAC, and Limited RBAC.

78
Q

Rule BAC

A

Based on rules within an ACL, uses a set of rules, restrictions, or filters to determine what can and cannot occur on a system. It includes granting a subject access to an object, or granting the subject the ability to perform an action. A distinctive characteristic about rule BAC models is that they have global rules that apply to all subjects.

79
Q

Rule BAC Example

A

A firewall, which includes a set of rules or filters within an ACL, defined by an administrator. The firewall examines all the traffic going through it and only allows traffic that meets one of the rules.

80
Q

Mandatory Access Control (BELL Model)

A

Latice based. Label all objects and subjects. Authorisation depends on security labels which indicate clearance and classification of objects. Access provided on a needs to know basis.

81
Q

Non-discretionary access control / Mandatory

A

A central authority determines what subjects have access based on policies. Role based / task based. Also lattice base can be applied

82
Q

Discretionary Access Control - Graham Denning

A

Allows the owner, creator, or data custodian of an object to control and define access to that object. DAC is implemented using ACLS on objects. Identity based access control is a subset of DAC. DAC is not centrally managed as the permissions of a file can be changed at the object level.

83
Q

Implicit Deny

A

Basic principle that most authorisation mechanisms use it. The implicit deny principle ensures that access to an object is denied unless access has been explicitly granted to a subject.

84
Q

Access Control Matrix

A

A table that includes subjects, objects, and assigned privileges. When a subject attempts an action, the system checks the access control matrix to determine if the subject has the appropriate privileges to perform the action.

85
Q

Capability Tables

A

They are different from ACLs in that a capability table is focused on subjects (such as users, groups, or roles). For example, a capability table created for the accounting role will include a list of all objects that the accounting role can access and will include the specific privileges assigned to the role for these objects.

86
Q

Difference between ACL and Capability Table

A

Difference is in focus. ACL are object focused and identify access granted to subjects for any specific object. While capability tables are subject focused and identify the objects that subjects can access.

87
Q

Permissions

A

Refer to the access granted for an object and determine what you can do with it. If you have read permission for a file, you’ll be able to open it and read it. You can grant user permissions to create, read, edit, or delete a file on a file server. Similarly, you can grant user access rights to a file, so in this context, access rights and permissions are synonymous.

88
Q

Rights

A

Refers to the ability to take an action on an object. For example, a user might have the right to modify the system time on a computer or the right to restore backed-up data. This is a subtle distintion and not always stressed. You’ll rarely see the right to take action on a system referred to as a permission.

89
Q

Privileges

A

Are the combination of rights and permissions. For example, an administrator for a computer will have full privileges, granting the administrator full rights and permissions on the computer. The administrator will be able to perform any actions and access any data on the computer.

90
Q

Constrained Interface Applications

A

This restricts what users can do or see based on their privileges. Applications constrain the interface using different methods. A common method is to hide the capability if the user doesn’t have permissions to use it. Other times, the application displays the menu item but shows it dimmed or disabled.

91
Q

Content-Dependent

A

Internal data of each field, data stored by a field, restrict access to data based on the content within an object. A database view is a content-dependent control. A view retrieves specific columns from one or more tables, creating a virtual table.

92
Q

Work Hours

A

Context-dependent control (such as 9-5)

93
Q

Need to Know

A

Ensures that subjects are granted access only to what they need to know for their work tasks and job functions. Subjects may have clearance to access classified or restricted data but are not granted authorisation to the data unless they actually need it to perform a job.

94
Q

Least Privilege

A

Ensures that subjects are granted only the privileges they need to perform their work tasks and job functions. This is sometimes lumped together with need to know. The only difference is that least privilege will also include rights to take action on a system.

95
Q

Seperation of Duties and Responsibilities

A

Ensures that sensitive functions are split into tasks performed by two or more employees. It helps to prevent fraud and errors by creating a system of checks and blanaces.

96
Q

Reconnaissance

A

Allows an attacker to find weak points to target directly with their attack code. Automated tools are used to assist in this process.

97
Q

IP Probes

A

First type of network reconnaissance carried out against a targeted network. Each address in a range is pinged with all responses logged. Addresses that do not produce a response are assumed to be unused and are ignored.

98
Q

Nmap Tool

A

One of the most common tools used to perform both IP probes and port scans.

99
Q

Three states of network ports

A
  1. Open: Port is open on system and application is actively receiving connections.
  2. Closed. The port is accessible, meaning firewall is allowing access, but there is no application accepting connections on that port.
  3. Filtered Nmap: Unable to determine whether a port is open or closed because a firewall is interfering with the connection attempt.
100
Q

Port Scans Results

A

Once identifying open ports, they identify public services running on each machine, for example, port 80 is used for web servers.

101
Q

Vulnerability Scans

A

Probe targeted systems to locate security flaws

102
Q

Service Provisioning Markup Language (SPML)

A

XML based language designed to allow platforms to generate and respond to provisioning requests.

103
Q

SOAP

A

Simple Object Access Protocol is a messaging protocol and could be used for any XML messaging, but is not a markup language itself.

- (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions