EXAM 3 FLASH

Question 1

Trusted Platform Model (TPM)

Answer 1

hardware solution on motherboard that assists with key generation and storage & random number generation. Keys are stored on a separate part of motherboard to ensure physical security protection

Question 2

Hardware Security Model (HSM)

Answer 2

device used to manage and/or store encryption keys. Can help with cryptographic features like encrypting, hashing, and using digital signatures.
Are usually connected using USB that provide tamper protection mechanisms from other users looking to find the usb via network

Question 3

Knowledge Based Authentication

Answer 3

method where the user is identified using using common set knowledge.
EX: When verifying bank info, the website has you to verify your address out of a lineup of similar addresses, knowledge that was set in place for you to verify later at the time of setup.

Question 4

Extensible Authentication Protocol (EAP)

Answer 4

designed to support multiple authentication mechanisms using PPP (Point to Point Protocol). Connecting authentication certificates, tokens, one time passwords, smart cards, etc.

Question 5

Challenge-Handshake Authentication Protocol (CHAP)

Answer 5

Provides Authentication through the usage of challenge and response protocol systems (called a 3 way handshake)
The client sends a message to the server, the server must send the correct message back for the authentication to be granted or denied (the last part of the handshake)

Question 6

Password Authentication Protocol (PAP)

Answer 6

Involves a two way handshake in where the password and username are sent across the link in clear text. Does not provide any protection from line sniffing and playback.

Question 7

802.1X

Answer 7

Authentication standard that supports port related authentication services between a user and an authorization device like an edge router. Commonly used on wireless access points.

Question 8

Remote Authentication Dial-In User Service (RADIUS)

Answer 8

(AAA Protocol and UDP transport) Provides client systems with authentication and access control within an enterprise network.
IS USUALLY A NETWORK ACCESS SERVER (NAS)

Question 9

Security Assertion Markup Language (SAML)

Answer 9

A single sign on capability used for web applications to ensure user identities can be shared and are protected.

Defines standard for exchanging authorization and authentication data between security domains.

XML based protocol

Question 10

Terminal Access Controller Access Control System Plus (TACACS+)

Answer 10

Protocol that takes a client/server model approach and handles authentication, authorization, and accounting (AAA) services. Similar to RADIUS in the AAA protocol system but this uses TCP transport method. (RADIUS uses UDP)

Question 11

Open Authorization (OAUTH)

Answer 11

is an open protocol that allows secure token based authorization from the web, mobile, and desktop applications using a simple and standard method. Designed to remove the need for users to share their passwords with third party applications. Instead, using a substituting token.

Question 12

OpenID

Answer 12

a simple identity layer on top of the OpenAuthorization protocol. Created to allow third party applications to authenticate your users for you by using the accounts that users already own.

Question 13

Kerberos

Answer 13

Third party authentication service that uses a series of tickets as tokens for authenticating users. The steps are protected using strong cryptography.
Communicates via. tickets

Question 14

Access Control Schemes

Answer 14

Refers to all security features used to prevent unauthorized access to a computer system or network

Question 15

Attribute Based Access Control (ABAC)

Answer 15

Evaluates specific rules and policies against attributes associated with a subject or object.
Major difference between ABAC and and Role Based Access Control (RBAC) is the ability to use boolean logic in access control decision.

Question 16

Role Based Access Control (RBAC)

Answer 16

each user is assigned a set of roles that he or she may perform. The roles that they are assigned to do are then turned into granted access permissions

Question 17

Rule Based Access Control (also is RBAC)

Answer 17

a series of rules will be contained in the ACL and will be used to determine whether access should be granted or not.

Question 18

Mandatory Access Control (MAC)

Answer 18

A means of restricting access to objects based on the sensitivity of information contained in the objects and the formal authorization of subjects to access information of such sensitivity.
(MULTILEVEL SECURITY)

Question 19

Discretionary Access Control (DAC)

Answer 19

A means of restricting access to objects based on the identity of subjects and or groups to who they belong to. The controls are discretionary.
(USES ACLs)

Question 20

Conditional Access

Answer 20

access control scheme in where specific conditions are examined before access is given. “is _____ then ______”
The list of conditions can be broad or narrow

Question 21

Privileged Accounts

Answer 21

accounts with greater than normal user access.
Root/Domain access.
Think, Administrative authority
Requires real time monitoring
may need to perform tasks via. remote session

Question 22

Public Key Infrastructure (PKI)

Answer 22

made up of hardware, applications, algorithms, users, and utilities that work together in order to allow secure and predictable communication

Question 23

4 Main types of Certificates

Answer 23

• End Entity Certificates
• CA Certificates
• Cross-Certification Certificates
• Policy Certificates

Question 24

End Entity Certificates

Answer 24

Issued by a CA to a specific subject

Question 25

CA Certificate

Answer 25

can be self assigned or assigned by a superior CA with a higher clearance within the hierarchical model

Question 26

Cross Certificates

Answer 26

Are used when independent CAs establish peer to peer trust relationships

Question 27

Policy Certificates

Answer 27

For higher security applications, a mechanism is required to provide centrally controlled policy information to PKI clients - this is done with a policy certificate

Question 28

KEY ( A certificate format)

Answer 28

a key file. “ .key”
Can be used for both public and private PKCS#8 keys
Must be encoded as binary (DER) or ASCII PEM

Question 29

Distinguished Encoding Rules (DER)

Answer 29

encoding rules that can be used to encode any data object into a binary file
Can be used for a single certificate

Question 30

Privacy Enhanced-Electronic Mail (PEM)

Answer 30

The most common format used by certificate authorities.
Encoded in ASCII that begins with —–“Begin Certificate”——, followed by Base 64 data and then closing with ——-“End Certificate”——-
Supports multiple digital certificates
PEM format is used any many different file types. “ .key, .pem, .cer” etc.

Question 31

PFX

Answer 31

PKCS#12 portable file format with .pfx extension
Binary format for storing server certificate
PFX files are usually used on Windows operating systems

Question 32

P 12

Answer 32

An alternative file extension for PKCS#12 file format

Question 33

P7B

Answer 33

PKCS #7 OR P7B format stored in base 64 ASCII format
File extension either .p7b or .p7c
Begins with ——“Begin PKCS7”——- and only contains certificates and chain certificates
Most common platforms are Windows and Java Torncat

Question 34

CER

Answer 34

.cer file extension to denote an alternative form from Microsoft, of CRT files
.cer or .crt files may be recorded as binary (DER) or ASCII PEM
these file extensions are synonymous
.cer for Microsoft and .crt for Unix based systems

Question 35

Online vs. Offline CA

Answer 35

if a