Domain 5 part 2 Flashcards
Occurs as individuals users gain more access to more systems. Can happen intentionally (SSO) and unintentionally (because users often gain new entitlements (access rights)as they take on roles or duties.
Access aggregation
Users gain more entitlements without shedding the old ones
Authorization creeping
Need to share common information Also refers to the policies, processes, and tech that establish user identities and enforce rules about access to digital resources.
Federated Identity Management
Contains a sample of the biometric factor used for comparison during authentication.
reference template
Process that issues service tickets
TGS
Parties that are authencticating
principal
Equivalant of MS domain
Realm
Process the initial request
Authentication server
Equivalent of a domain controller
KDC
MAC defines subjects as —- and objects as ——
active and passive entities upon which subjects act
Access protocol that may be used for authentication wherein X500 tree is present
LDAP
Proposed successor to a very popular prot that uses TCP 3868 and encrypts authorization info. Provides better password protection by allowing a 2-factor strong authentication. Uses port 49 TCP bi-directional
TACACS+
cisco-based prot runs over TCP 49 bi-directional. Requires users to send an ID and static password for authentication. Using reusable password is vulnerability
TACACS
Ticket based authentication proto
kerberos
Generic term for centrally controlled authentication to multiple disparate systems
SSO
AAA proto runs over UPD 1812 and encrypts inbound info but not all of the authorization info. Authenticates a subject’s credentials against an authentication db. Authorizes users by allowing specific users to access specific data objects.
Radius
Concerned about certificates. Authorization, Authentication, and accounting. proto runs over UPD 1812 and encrypts inbound info but not all of the authorization info. Authenticates a subject’s credentials against an authentication db. Authorizes users by allowing specific users to access specific data objects.
Radius
Adds to kerberos. Scaliablity of public key systems, better manageabilitiy and audit and delegation. Adds public key assymmetric encryption. Addresses a big weakness in successor which is plaintext storage of symmetric keys
SESAME
Adds to Kerberos. Scalability of public key systems, better manageability and audit and delegation. Adds public key asymmetric encryption. Addresses a big weakness in successor which is plaintext storage of symmetric keys
SESAME
