Domain 5 - Identity and Access Management Flashcards by Jacob Shadix

Q

Information that is created, consumed or modified by an organization. Could be labeled as a ______?

A

Asset

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

All about the relationship between users and data.

A

Access Control

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

What control type is defined by the following:

a. Fences
b. locks
c. bio metrics
d. mantraps
e. lighting
f. separation of duties
g. job rotation
h. data classification
i. CCTV

A

Preventative

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

What control type is defined by the following:

a. security guards
b. motion sensors
c. audit trails
d. review of CCTV footage
e. honeypots | honeynets
f. IDS
g. incident response

A

Detective

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

What control type is defined by the following:

a. rebooting a system
b. terminating a system
c. A/V software quarantine
d. data restoration
e. IPS

A

Corrective

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

What control type is defined by the following:

a. policies
b. awareness training
c. locks
d. fences
e. warning signs
f. guards
g. mantraps
h. CCTV

A

Deterrent

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

What control type is defined by the following:

a. fault tolerant systems
b. system clusters
c. imaging
d. mirroring

A

Recovery

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

What control type is defined by the following:

a. procedures
b. exit signage
c. announced commands

A

Directive

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

What control type is defined by the following:

a. When guard is not present to sign in, use badge to swipe
b. when badge swipe does not work, use intercom and CCTV system to request access.

A

Compensating

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Provides AAA services between network access servers and an authentication server. The network access server is the client of the ______ server.

A

RADIUS (PROTOCOL for AAA)

RADIUS only encrypts the password exchange, not the rest of the authentication traffic. Uses UDP.

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Open source solution for TACACS and XTACACS. Separates AAA processes, allowing them to be hosted separately if necessary.

A

TACACS+ (PROTOCOL for AAA)

Encrypts ALL authentication information and uses TCP 49

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Uses TCP port 3368 or Stream Control Protocol (SCTP) port 3668. Supports IPSEC and TLS

A

Diameter

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

What process defines the following:

a. Identification
b. Authentication
c. Authorization
d. Access / Auditing

A

IAAA

Access Control Life cycle

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

“subject claiming an identity”

A

Identification

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

“Verifies / validates identity of subject through comparison of factors provided (provides validity) “

A

Authentication

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

“Subject is granted access to object based on validated identity”

A

Authorization

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

“Subject interacts with object”

A

Access

Tracked through auditing

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Something you have …

A

Smartcard or Token

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Something you know …

A

Pin or password

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Something you are …

A

Biometric

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

3 categories of control are ______

A

Administrative, Technical and Physical

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

2 types of bio-metrics are ?

A

Physiological (Fingerprints …etc)

and

Behavioral (Signature and Keystrikes)

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

All users authenticate back to a central authentication server from remote offices.

A

Centralized Access Control

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Authenticate once to centralized access control

A

Single sign On

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

x.500 standard

LDAP

x.400 Standard

Email

Ticket bases authentication solution relying on symmetric encryption using AES. . Provides confidentiality and integrity for authentication traffic end to end

Kerberos

Kerberos: Verifies and accepts/rejects tickets based on authenticity and timeliness

Authentication Server

Kerberos: Issues tickets to authorized users

Ticket Granting Server

Kerberos: An encrypted message that provides some form or type of proff depending on what type of ticket it is. 2 Types of tickets. Ticket Granting Ticket Service ticket

Ticket

Kerberos: Proof that subject has authenticated through a KDC successfully and is authorized to request additional service ticket to access objects

Ticket Granting Ticket (TGT)

Kerberos: Proof that a subject is authorized to access an object

Service Ticket (ST)

A third party solution that provides identity and access management. These are clod based servies that broker identifity nad access mgmt functions to target systems on customers' premises and/or in the cloud.

Identity as a Service (IDaaS)

Access to an object is denied unless access has been explicitly granted

Implicit Deny

Table that is made up of subjects, objects and assigned privileges. System checks the matrix to see whether a subject has appropriate privileges to carry out an activity.

Access Control Matrix

Sub focused, as opposed to an ACL which is object focused.

Capability Table

A view that only allows access to features/abilities granted to the subject Database Views!!!

Constrained Interface Database Views!!! (Limited menus inside of an application. Not being able to see admin interface but only what you are entitled to)

Bases access control authorization on roles or functions, that are assigned to a user within an organization.

Role Based Access Control (RBAC)

grants use access to data or an application using ACLS

NON-RBAC

Users are mapped to roles within a single application rather than through an organization wide role structure

Limited RBAC

Applies a role to multiple applications or systems based on a users specific role within the organization.

Hybrid RBAC

Roles are defined organizations policy and access control infrastructure and then applied to applications and systems across the enterprise

FULL RBAC

access is based on list of predefined rules that determine what access should be granted. Most commonly a form of DAC.

Rule based access control Example: Firewalls

Lattice-based - requires the system to manage access controls in accordance with the organizations security policies and where system owners do not want to allow users to potentially contradict or bypass organizationally mandated access.

Mandatory Access Control

Restrict access to data based on the content of the object. VIEWS IN A DATABASE

Content-Dependent Access Control

Based on the context or specific actions that are happening (or not)

Context-Dependent Access Control

Use of rules defining one or more attributes

Attribute Based Access Control

Bad actor looking to do harm

Cracker

Attempt to bypass or circumvent access control methods

Access Control Attacks

Collecting multiple pieces of nonsensitive information that are combined to understand sensitive information

Access aggregation Attacks Counter measures: Defense in depth with least privilege can be effective counter measure.

Attempt to discover passwords by using all possible passwords in a predefined list

Dictionary Attack Counter measures: Complex changing passwords, every 30 days

Combination of dictionary and brute force attacks

Hybrid Attack Counter measures:Complex changing passwords, every 30 days

All about collisions!! 2 things to keep in mind: 1. small is bad 2. same hash - different password = SUCCESS

Birthday Attack Counter measures: Large work factor

Attempt to shortcut using tables of pre-computed hash values

Rainbow table attack Counter measures: a. Salt b. Pepper

Attacking specfic group of users

Spear Phisihing

Phishing attack targeting senior executives

Whaling

Pretending to be someone else in hope of assuming their identify

Spoofing Countermeasure: MFA

An attempt to gain trust of targeted individual in hopes of getting them to reveal useful information.

Social Engineering Attack

Phishing attack using VOIP or IM

Vishing

Side channel differential power analysis timing

Smart Card Attacks

1. Control Physical Access to System 2. Control electronic access to system 3. create and enforce a strong password policy 4. hash, salt & pepper password 5. employ password masking, obfuscation and tokenization 6. MFA 7. Account lock controls 8. last logon notification 9. Awareness Training

Protection Methods