Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

COMPTIA - Sec+ Textbook > Lesson 6: Implementing Identity and Access Management Controls > Flashcards

Lesson 6: Implementing Identity and Access Management Controls Flashcards

1
Q

access control system

A

set of technical controls that govern how subjects may interact with objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

subjects

A

users, devices, or software processes, or anything else that can request and be granted access to a resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

objects

A
  • resources
  • examples:
  • networks
  • servers
  • databases
  • files
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Access Control List (ACL)

A
  • basis of access control

- list of subjects and rights or permissions they have been granted on the object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Identity and Access Management (IAM)

A

four main processes:

  • Identification
  • creating an account or ID that identifies the user, device, or process on the network
  • associates a particular user (or software process) with an action performed on a network system
  • vital first steps in access control process
  • Authentication
  • proving that a subject is who or what it claims to be when it attempts to access the resource
  • that someone or something is not masquerading as a genuine user
  • vital first steps in access control process
  • Authorization - determining what rights subjects should have on each resource, and enforcing those rights
  • Accounting - tracking authorized usage of a resource or use of rights by a subject and alerting when unauthorized use is detected or attempted
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

non-repudiation

A

user should not be able to deny what s/he has done

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

account

A

consists of an identifier (must be unique), credentials, and a profile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Security Identifier (SID) string

A
  • account is actually defined on this system
  • if the user account was deleted and another account with the same name subsequently created, the new account would have a new SID and, therefore, not inherit any of the permissions of the old account
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

issuance (or enrollment)

A

means processes by which a subject’s credentials are recorded, issued, and linked to the correct account, and by which the account profile is created and maintained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

issues of issuance (or enrollment)

A
  • identity proofing - verifying that subjects are who they say they are at the time the account is created
    (Websites that allow users to self-register typically employ a CAPTCHA (Completed Automated Public Turing Test to Tell Computers and Humans Apart - a CAPTCHA is usually a graphic or audio of some distorted letters and digits)
  • ensuring only valid accounts are created
  • secure transmission of credentials
  • revoking the account if it is compromised or no longer in use
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

two techniques to mitigate confusion of digital identities

A
  • password reset - automating the password reset process reduces the administration costs associated with users forgetting passwords but making the reset process secure can be problematic
  • single sign-on - this means that all network resources and applications accept the same set of credentials, so subject only needs to authenticate once per session
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

something you know authentication

A
  • username
  • password
  • passphrase (longer password comprising several words, advantages of being more secure and easier to remember)
  • Personal Identification Number (PIN)
  • account reset mechanisms:
  • challenge questions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

something you have authentication

A
  • smart card
  • USB token
  • key fob
  • digital certificate

concerns:
- cryptographic access control technologies are subject to loss and theft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

something you are authentication

A
  • employ some sort of biometric recognition system
  • fingerprint
  • iris or retina recognition
  • facial recognition
  • template: the chosen biometric information scanned and recorded in a database

main problems:

  • users can find it intrusive and threatening to privacy
  • technology can be discriminatory or inaccessible to those with disabilities
  • setup and maintenance costs to provision biometric readers
  • vulnerability to spoofing methods
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

something you do authentication

A
  • refers to behavioral biometric recognition

- analyzes a behavior such as typing or writing a signature, variations in speed and pressure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

somewhere you are authentication

A
  • location-based authentication measures some statistic about where you are:
  • Global Positioning System (GPS) or indoor Position System (IPS): this could be a geographic location, measured using a device’s location service
  • IP address or geolocation
  • VPN gateway
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

multifactor authentication

A
  • combines use of more than one type of something you know/have/are (multifactor)
  • two-factor authentication (2FA): combines something like a smart card or biometric mechanism with something you know, such as a password or PIN
  • three-factor authentication combines all three technologies, or incorporates an additional location-based factor
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

mutual authentication

A
  • security mechanism that requires that each party in a communication verifies each other’s identity
  • shared secret (configured on both server and client)
  • prevents:
  • client from inadvertently submitting confidential information to a non-secure server
  • helps in avoiding Man-in-the-Middle and session hijacking attacks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

LAN Manager (LM or LANMAN)

A

challenge/response authentication protocol; this means that the user’s password is not sent to the server in plaintext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

NTLM authentication

A
  • designed to work over trusted local network
  • password is Unicode and mixed case and can be up to 127 characters long
  • the 128-bit MD4 hash function is used in place of DES
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

LM/NTLM vulnerabilties

A
  • obsolete
  • designed to work over trusted local network

NTLM

  • only provides for client authentication, making it vulnerable to Man-in-the-Middle attacks
  • vulnerable to pass-the-hash attack (where an attacker submits a captured authentication hash rather than trying to obtain the plaintext password)
  • does not support token or biometric authentication
22
Q

Kerberos

A
  • network authentication protocol developed by Massachusetts Institute of Technology (MIT)
  • named after the three-headed guard dog of Hades (Cerberus), consists of three parts:
  • clients: requests services from a server
  • server
    • both clients and servers rely on an intermediary–a Key Distribution Center (KDC)–to vouch for their identity
  • drawbacks of Kerberos:
  • KDC represents a single point-of-failure for the network
23
Q

Key Distribution Center (KDC)

A
  • runs on port 88 using TCP or UDP
  • two services that make up a KDC:
  • Authentication Service (AS)
  • responsible for authenticating user logon requests
  • Ticket Granting Ticket (TGT)
  • client sends AS a request for a TGT, composed by encrypting the date and time on the local computer with the user’s password hash as the key
  • TGS session key - for use in communications between client and the Ticket Granting Service (TGS)
  • Service ticket - token that grants access to a target application server (contains info about the user, timestamp, system IP address, Security Identifier (SID), and the SIDs of groups to which s/he belongs, and the service session key)
24
Q

Password Authentication Protocol (PAP)

A

unsophisticated authentication method developed as part of the TCP/IP Point-to-Point Protocol (PPP), used to transfer TCP/IP data over serial or dial-up connections

25
Q

Challenge Handshake Authentication Protocol (CHAP)

A
  • also developed as part of PPP as a means of authenticating users over a remote link
  • relies on an encrypted challenge in a system called a three-way handshake:
  • challenge-server challenges the client, sending a randomly generated challenge message
  • response-client responds with a hash calculated from the server challenge message and client password (or other shared secret)
  • verification-server performs its own hash using the password hash stored for the client
26
Q

Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)

A
  • Microsoft’s first implementation of CHAP
  • should not be deployed without the protection of a secure connection tunnel so that the credentials being passed are encrypted
27
Q

password attacks

A
  • adversary directly interacts with the authentication service–a web login form or VPN gateway, for instance
  • attacker will submit passwords using either a database of known passwords (and variations) or list of passwords that have been cracked offline
  • online password attack can show up in audit logs as repeatedly failed logons and then a successful logon, or as several successful logon attempts at unusual times or locations
28
Q

password cracker

A
  • software works on basis of exploiting known vulnerabilities in password transmission and storage algorithms (LM and NTLM hashes, for instance)
  • can perform brute force attacks and use precompiled dictionaries and rainbow tables to break naively chose passwords
  • as once the password database has been obtained, the cracker does not interact with the authentication system to perform the cracking (offline attack)
29
Q

well-known password cracking tools

A

John the Ripper
- multi-platform password hash cracker

THC Hydra
- often used against remote authentication (protocols such as Telnet, FTP, HTTPS, SMB, and so on)

Aircrack
- sniffs and decrypts WEP and WPA wireless traffic

L0phtcrack
- one of the best-known Windows password recovery tools, also an open source version (ophcrack)

Cain and Abel
- Windows password recovery with password sniffing utility

30
Q

password cracker attack types

A

brute force attack
- attempts every possible combination in the key space (determined by number of bits used, length of key) in order to derive a plaintext password from a hash

dictionary and rainbow table attacks
- dictionary attack can be used where there is a good chance of guessing the likely value of the plaintext, such as a non-complex password, rather than attempting to compute every possible value, the software enumerates values in the dictionary

  • rainbow table attacks
  • refine dictionary approach, attacker uses a precomputed lookup table of all possible passwords and their matching hashes

hybrid attack
- uses a combination of dictionary and brute force attacks

31
Q

salt

A
  • random value added to the plaintext
  • can help hash functions be more secured
  • helps slow down rainbow table attacks against a hashed password database
32
Q

key stretching

A
  • technique to make the key generated from a user password stronger is by–basically–playing around with it lots of times
  • initial key may be put through thousands of rounds of hashing
33
Q

bcrypt

A
  • extension of the crypt UNIX library for generating hashes from passwords, uses Blowfish cipher to perform multiple rounds of hashing
34
Q

Password-Based Key Derivation Function 2 (PBKDF2)

A

part of RSA security’s public key cryptography standards (PKCS#5)

35
Q

Pass-the-Hash (PtH) attacks

A
  • if an attacker can obtain the hash of a user password, it is possible to present the hash (without cracking it) to authenticate to network protocols such as CIFS
  • principal defense against these types of attacks is to strongly restrict the workstations that will accept logon (interactive or remote) from an account with domain administrative privileges
36
Q

token

A
  • various ways to authenticate a user based on something they have
  • examples
  • smart card
  • USB token
  • key fob (that contains a chip with authentication data, such as a digital certificate)
37
Q

smart card

A
  • credit card-sized device with an integrated chip and data interface
  • either contact-based, meaning physically inserted into a reader or contactless, meaning that data is transferred using a tiny antenna embedded in the card (can also be referred to a proximity card)
38
Q

IEEE 802.1X/Extensible Authentication Protocol (EAP)

A
  • smart cards and other token-based systems are often configured to work with the IEEE 802.1X Port-based Network Access Control framework
  • 802.1X establishes several ways for devices and users to be securely authenticated before they are permitted full network access
    (the actual authentication mechanism will be some variant of the Extensible Authentication Protocol, EAP)
39
Q

One-time Password (OTP)

A
  • generated automatically (rather than being selected by a user) and used only once
  • not vulnerable to password guessing or sniffing attacks
  • generated using some sort of hash function on a secret value plus a synchronization value (seed), such as a timestamp or counter
40
Q

T or F. Software token on a server that is sent to a resource that is assumed to be safely controlled by the user, such as a smartphone or email account is not strictly a something you have have authentication factor.

A

True

41
Q

Initiative for Open Authentication (OATH)

A
  • an industry body comprising mostly the big PKI providers, such as Verisign and Entrust, established with the developing an open, strong authentication framework
  • open means a system that any enterprise can link into to perform authentication or on 2-step verification
42
Q

HMAC-based One-time Password Algorithm (HOTP)

A
  • algorithm for token-based authentication

- authentication server and client token are configured with the same shared secret

43
Q

Time-based One-time Password Algorithm (TOTP)

A
  • refinement of the HOTP
  • issue
  • tokens can be allowed to persist unexpired, raising the risk that an attacker might be able to obtain one and decrypt data in the future
44
Q

biometric authentication

A
  • first step in setting up biometric authentication is enrollment
  • scanned by biometric reader and converted to binary information

two steps in the scanning process:

  • sensor module acquires the biometric sample from the target
  • feature extraction module records the significant information from the sample (features that uniquely identify the target)
  • vendors have developed proprietary biometric cryptosystems to address security
45
Q

biometric factors

A
  • Crossover Error Rate (CER) - point at which FRR and FAR meet, the lower the CER, the more efficient and reliable the technology
  • Throughput (speed)—this refers to the time required to create a template for each user and the time required to authenticate. This is a major consideration for high traffic access points, such as airports or railway stations
  • key metrics and considerations used to evaluate different technologies include the following:
  • false negatives (where legitimate user is not recognized); referred to as False Rejection Rate (FRR) or Type I error
  • false positives (where an interloper is accepted); referred to as False Acceptance Rate (FAR) or Type II error
46
Q

fingerprint scanners

A
  • fingerprint recognition is the most widely implemented biometric technology
47
Q

retinal scan

A
  • an infrared light is shone into the eye to identify the pattern of blood vessels
  • arrangement of these blood vessels is highly complex and typically does not change from birth to death, except in the event of certain diseases or injuries
  • most accurate forms of biometrics, very secure
  • equipment required is expensive and the process is relatively intrusive and complex
  • false negatives can be produced by disease, such as cataracts
48
Q

iris scan

A
  • patterns on the surface of the eye using near-infrared imaging and so is less intrusive than retinal scanning (the subject can continue to wear glasses, for instance), and a lot quicker
  • Iris scanners offer a similar level of accuracy as retinal scanners but are much less likely to be affected by diseases
  • Iris scanning is the technology most likely to be rolled out for high-volume applications, such as airport security
  • there is a chance that an iris scanner could be fooled by a high-resolution photo of someone’s eye
49
Q

facial recognition scanners

A
  • records multiple indicators about the size and shape of the face, like the distance between each eye, or the width and length of the nose
50
Q

behavioral technologies

A
  • something you do
  • can be discriminatory against those with disabilities:
  • voice recognition - cheap, as the hardware and software required are built into many standard PCs and mobiles
  • signature recognition - tracks stroke speed, and pressure of stylus, easy to duplicate
  • typing - matches speed and patter of a user’s input of a passphrase
51
Q

Common Access Cards

A
  • in the US, the homeland Security Presidential Directive 12 (HSPD-12) mandated that access to Federal property must be controlled by a secure identification and authentication mechanism (as defined in FIPS-201 standard)
  • two identity cards have been introduced:
  • Common Access Card (CAC)–issued to military personnel, civilian employees, and contractors to gain access to Department of Defense (DoD) facilities and systems
  • Personal Identification Verification (PIV) Card–for civilian Federal government employees and contractors
52
Q

Guidelines for Implementing IAM

A
  • Ensure robust procedures for creating accounts that identify network subjects (users and computers) and issue credentials to those subjects securely
  • Determine which authentication factors and technology provide the best security, given any limitations imposed by existing infrastructure and budget
  • Consider that using PIV or CACs may be mandatory if you work with or for the U.S. federal government

COMPTIA - Sec+ Textbook (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions