Identity and Access Management

Question 1

PAP

Answer 1

Password Authentication Protocol
Used with PPP (Point-to-point protocol).
Sends passwords over a network in cleartext.
Used as last resort

Question 2

MS-CHAP and MS-CHAPv2

Answer 2

Microsoft Challenge Handshake Authentication Protocol.
Improvement over CHAP. MS-CHAPv2 allows for performing mutual authentication which means the client authenticates to the server AND the server authenticates to the client.

Question 3

CHAP

Answer 3

Challenge Handshake Authentication Protocol.
Uses PPP and authenticates remote users. Client and server both know a shared secret used in the authentication protocol.

Question 4

RADIUS Defintion

Answer 4

Remote Authentication Dial-In User Service.
Centralized authentication service. RADIUS can also be used as an 802.1x server with WPA2 Enterprise mode. It is common for a RADIUS server to access a LDAP server that holds accounts as opposed to holding the database itself. Uses UDP, only encrypts password, not entire authentication process

Question 5

TACACS+ Definition

Answer 5

Terminal Access Controller Access-Control System Plus. Cisco alternative to RADIUS. Encrypts the entire authentication process, where RADIUS only encrypts the password. TACACS+ uses multiple challenges and responses between the client and the server. Can interact with Kerberos.

Question 6

Diameter

Answer 6

Extension of RADIUS. Uses TCP instead of UDP. Backwards compatible with RADIUS. Capable of secure transmissions with EAP

Question 7

Role-Based Access Control

Answer 7

Uses roles to manage rights and permissions. Administrator creates roles and assigns them specific roles and permissions and then adds users to that role as necessary. It’s common to document roles and their privileges in a matrix

Question 8

Group-based access control

Answer 8

A common way to implement role-based access control is with groups. Microsoft uses built-in security groups

Question 9

Rule-based Access Control

Answer 9

Based on a set of approved instructions, such as an access control list. Some rule-BAC systems use rules that trigger in response to an event

Question 10

Discretionary Access Control

Answer 10

Every object (Files, folders, etc.) has an owner. Owner establishes access for the objects. Common example is New Technology File System (NTFS) used in Windows

Question 11

Mandatory Access Control

Answer 11

Uses labels to determine access. Widely used by military units. MAC model uses a lattice to divide access into separate compartments

Question 12

Attribute-Based Access Control

Answer 12

Uses attributes defined in policies to grant access to resources. Commonly used in Software Defined Networks (SDNs)