Identity & Access Management Flashcards
EAP
Extensible Authentication Protocol
Integrates with 802.1X
Framework commonly used for wireless networks ; EAP-TLS, LEAP , EAP-TTLS, PEAP.
CHAP
Challenge Handshake Authentication Protocol.
Uses an encrypted challenge and three-way handshake to send credentials
-Challenge message
-Password hash from challenge and password
-Server compares hash
802.1X
IEEE standard for network access control (port based NAC)
RADIUS, LDAP, TACACS+
Supplicant - the client
Authenticator- go between provides access
Server - validates credentials
What is RADIUS?
Remote Authentication Dial-in User Service
Operates via TCP or UDP
sends passwords that are obfuscated by a shared secret and MD5 hash.
Typically encrypted using IPSec
TACACS+
Terminal Access Controller Access Control System
Cisco designed, uses TCP for AAA providing full packet encryption and granular command controls
Kerberos
Favoured by Microsoft: Operates on untrusted networks and uses authentication to shield its traffic.
The primary - username
The instance - to differentiate similar primaries
The realm - groups of users separated by trust boundaries.
TGT
Ticket Granting Ticket
When I client wants to use Kerberos to access a service they request this; (authentication ticket)
TGS
Ticket Granting Service (Kerberos)
KDC
Kerberos Distribution Centre
SAML
Security Assertion Markup Language
XML based open standard for exchanging AA information between identity and service providers
LDAP
Lightweight Directory Access Protocol
Deployed as part of an identity management infrastructure database to offer hierarchically organised directory
MFA
Multi Factor Authentication
-something you know
-something you have
-something you are
- somewhere you are
- something you can do
- something you exhibit
- someone you know
TOTP
Time-based One Time Passwords
Use algorithm to drive a password using current time as part of the process, and is valid for set period
eg Google Authenticator
HMAC
Hash Based Message Authentication Code
HOTP
HMAC based One Time Password
(Hash Based Authentication Code)
FRR
False Rejection Rate
FAR
False Acceptance Rate
ROC
Relative Operating Characteristics (biometrics) compares the FAR and FRR of a system typically as a graph
COR
Cross Over Error Rate (biometrics)
Where FRR and FAR intersect
Lower is better
KBA
Knowledge Based Authentication
I.e. security questions
TPM
Trusted Platform Module
Cryptoprocessor Modules or chips help prevent unauthorised changes to firmware or software as part of secure boot
HSM
Hardware Security Module
Create, store, manage crypto keys
ABAC
Attribute Based Access Control
For setups requiring more complex options than RBAC
RBAC
Role Based Access Control
R(u)BAC
Rule Based Access Control
MAC (security not hardware)
Mandatory Access Control
DAC
Discretionary Access Control
I.e self managing file permissions
OAuth
Protocol to allow users to grant 3rd party access without providing password, typically used by OpenID providers
I.e Login with Google is an OpenID provider
PAM
Privileged Access Management
Tools focus on principles of ‘least privilege’
SIEM
Security Information Event Management
Software provides real time analysis of security alerts generated by apps and (network) hardware
X.509
International standard governing digital certificates
WPA2
CCMP (Counter mode with Cipher block chaining Message authentication code Protocol /CNC-MAC)
DATA protected with AES
Message integrity Check (MIC) CBC-MAC
WPA3
Uses different block cipher mode: GCMP (Galois/Counter Mode Protocol)
Data integrity with AES
MIC with GMAC
WPA2 PSK problem
Can listen to 4 way handshake | capture hash and then brute force
SAE
Simultaneous Authentication of Equals
In WPA3 gives mutual authentication with 4 way (dragonfly) handshake which gives shared key without sending across the network
EAP-FAST
EAP Flexible Authentication Secure Tunnel
Server and supplicant share PAC
Supplicant and AS negotiate TLS Tunnel
Needs RADIUS
PEAP
Protected EAP
CISCO, MS & RSA
Also encapsulate ms in TLS
Server uses a certificate instead of PAC (protected access credential/secret)
Combined with CHAP with MS
EAP-TLS
Requires digital certificates in all devices with an exchange so need PKI
EAP-TTLS
EAP-TunneledTLS
Only a certificate on the AS to build a tunnel and uses any authentication method in the tunnel
Linux File Permissions 0-7
0 - - -
1 - - x
2 -w-
3 -wx
4 r- -
5 r-x
6 rw-
7 rwx
