Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sec+ > Lesson 8 > Flashcards

Lesson 8 Flashcards

1
Q

Federated Identify management

A

cloud based identify manage provider enables access to many platforms. similar to Kerberos SSO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

• Certificates and smart cards

A
  • Public key cryptography
  • Subject identified by a public key, wrapped in digital certificate
  • Private key must be kept secure
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Tokens

A
  • Authorizations issued under single sign-on

* Avoids need for user to authenticate to each service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

• Identity provider

A
  • Provisions and manages accounts
  • Processes authentication
  • Federated identity management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

• Separation of duties

A
  • Separation of duties
  • Standard operating procedures (SOPs)
  • Shared authority
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

• Least privilege

A

Assign sufficient permissions only

• Reduce risk from compromised accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

• Job rotation

A
  • Distributes institutional knowledge and expertise

* Reduces critical dependencies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

• Mandatory vacations

A

During that time, the
corporate audit and security employees have time to investigate and discover any
discrepancies in employee activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

• User-assigned privileges

A

• Assign privileges directly to user
accounts
• Unmanageable if number of users
is large

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

• Group-based privileges

A 
• Assign permissions to security 
groups and assign user accounts 
to relevant groups
• Issues with users inheriting 
multiple permissions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Service accounts

A

are used by scheduled processes and application server software, such
as databases.

Must manage share service acccount credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Shared/Generic/Device Accounts and Credentials

A
  • Shared accounts
  • Accounts whose credentials are known to more than one person
  • Generic accounts
  • Accounts created by default on OS install
  • Only account available to manage a device
  • Might use a default password
  • Risks from shared and generic accounts
  • Breaks principle of non-repudiation
  • Difficult to keep credential secure
  • Credential policies for devices
  • Privilege access management software
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

• Privilege access management software

A

stores high-risk credentials somewhere other than a spreadsheet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SSH

A 
• Secure Shell (SSH) used for remote 
access
•     Host key identifies the server
•     User key pair used to authenticate to 
server
•     Server holds copy of valid users’ 
public keys
•     Keys must be actively managed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

• Third-party credentials

A

Passwords and keys to manage
cloud services
• Highly vulnerable to accidental
disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Account Password Policy Settings

A
  • Length
  • Complexity
  • Character combinations
  • Aging
  • History and reuse
  • NIST guidance
  • Password hints
17
Q

Account Restrictions

A 
Network location
•     Connecting from a VLAN or IP subnet/remote IP
•      Connecting to a machine type or group (clients versus servers)
• Interactive versus remote logon
• Geolocation
•     By IP address
•     By Location Services
•     Geofencing
•     Geotagging
• Time-based restrictions
• Logon hours
• Logon duration
• Impossible travel time/risky login
18
Q

geoloction vs geotagging vs geofencing

A

geolocation: location of a user or device can also be calculated using a geolocation

Geofencing: refers to accepting or rejecting access requests based on location.\

Geotagging refers to the addition of location
metadata to files or devices.

19
Q

Account Audits

A 
• Accounting and auditing to detect 
account misuse
•     Use of file permissions to read 
and modify data
•     Failed login or resource access 
attempts
• Recertification
•      Monitoring use of privileges
•      Granting/revoking privileges
•      Communication between IT and 
HR
20
Q

Account Permissions

A 
• Impact of improperly configured 
accounts
•      Insufficient permissions
•      Unnecessary permissions
• Escalating and revoking privileges
• Permission auditing tools
21
Q

Disablement vs lockout

A 
• Disablement
•      Login is disabled until manually reenabled
•     Combine with remote logoff
• Lockout
•      Login is prevented for a period 
and then re-enabled
•      Policies to enforce automatic 
lockout
22
Q

Discretionary vs Role-based access

A
  • Discretionary Access Control (DAC)
  • Based on resource ownership
  • Access Control Lists (ACLs)
  • Vulnerable to compromised privileged user accounts
  • Role-Based Access Control (RBAC)
  • Non-discretionary and more centralized control
  • Based on defining roles then allocating users to roles
  • Users should only inherit role permissions to perform particular tasks
23
Q

File System Security

A
  • Access Control List (ACL)
  • Access Control Entry (ACE)
  • File system support
  • Linux permissions and chmod
  • Symbolic (rwx)
  • User, group, world
  • Octal
  • r=4
  • w=2
  • x=1
24
Q

Mandatory vs Attribute-based access control

A

Mandatory Access control
Labels applied to objects (secret, top seecrat) and clearanced applied subjects

Attribute-Based Access Control (ABAC)
• Access decisions based on a combination of subject and object attributes plus
any context-sensitive or system-wide attributes
• Conditional access

25
Q

Rule-Based Access Control

A

Rule-based access control is a term that can refer to any sort of access control model
where access control policies are determined by system-enforced rules rather than
system users.

 Non-discretionary
• System determines rules, not users
Conditional access
• Continual authentication
• User account control (UAC)
Privileged access management
• Policies, procedures, and technical controls to prevent the malicious abuse of 
privileged accounts
26
Q

Directory Services

A

Database of subjects (Windows = Active Directory)
• Users, computers, security groups/roles, and service Access Control Lists (authorizations)
X.500 and Lightweight Directory Access Protocol (LDAP)
• Distinguished names
• Attribute=Value pairs

27
Q

Protocol used for Directory Services

A

• X.500 and Lightweight Directory Access Protocol (LDAP)

The Lightweight Directory Access Protocol (LDAP) is a
protocol widely used to query and update X.500 format directories.

28
Q

Federated identity

management

A

Federation -is the notion that a network needs to be accessible to more than just a
well-defined group of employees. As an example, you can log into twitter with your google account. google verifies the identity.

29
Q

Attestation

A

verification from and identity provider (IdP) that that user is who she says she is

30
Q

Security Assertions Markup Language (slide 31)

A

skipped this one

31
Q

API

A

API is the acronym for Application Programming Interface, which is a software intermediary that allows two applications to talk to each other.

32
Q

REST

A

• Representational State Transfer (REST) Application Programming
Interfaces (APIs) (RESTful APIs)
• Framework for implementation not a protocol

Many public clouds use application programming interfaces (APIs) based on
Representational State Transfer (REST) rather than SOAP. These are often called
RESTful APIs. Where SOAP is a tightly specified protocol, REST is a looser architectural
framework. This allows the service provider more choice over implementation
elements.

33
Q

OAuth

A

• Designed to communicate authorizations rather than explicitly
authenticate a subject
• Client sites and apps interact with OAuth IdPs and resource servers
that hold the principal’s account/data
• Different flow types for server to server or mobile app to server
• JavaScript object notation (JSON) web token (JWT)

34
Q

• OpenID Connect (OIDC)

A

• Adds functions and flows to OAuth to support explicit
authentication

**Remember, OAuth is more designed to communicat authorizations vs authenticating a subject

35
Q

AUP

A

Acceptable use policy (AUP)

• Employee use of employer’s hardware and software assets

Sec+ (23 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions