Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CS6035 - Intro to Info Sec > P1L4: Authentication > Flashcards

P1L4: Authentication Flashcards

1
Q

What is authentication?

A

Who are you and prove it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is authorization?

A

Does this requester have permission to access this resource?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Authentication goals

A

Availability: When the correct credentials are presented, the resources should be made available.No false negatives: A false negative is when a process presents the correct credentials, but access is denied.No false positives: A false positive is if the incorrect credentials are presented, but access is given.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How is authentication implemented?

A

Something only the user knows: password, pinSomething the user has: token, smart card, etc.Something the user is: fingerprint, iris scan, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

To authenticate

A
  1. capture evidence2. compare it3. authenticate it
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Examples of threats to authentication system

A

–guessing PW–impersonating a real login program (ie a trojan horse)–keylogging: grabs keystrokes to record password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Trusted Path

A

Connection between the user and the TCB. Should be provided by the OS and hardware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Trusted Login Path

A

Keyboard and display must have trusted paths to OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Implementing PW authentication: Method 1

A

Store a list of passwords, one for each user in the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Implementing PW authentication Method 2

A

Do not store passwords, but store something that is derived from them. (ie use a one-way hash function and store the result)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Hash function threats: Assume one-way property

A

If we know common passwords, we can determine their hash.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Hash function threats: Dictionary attacks

A

The program has a dictionary of common passwords and try each one (brute force). Requires access to hash values and lots of time to test for matches.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Hash function threats: Offline attacks

A

Take the dictionary of common passwords and compute the hash values for each. Then search the hash file offline for any matching hashes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

T/F: Hackers can acquire publicly available software that can do 10^8 MD5 hashes/sec on a GPU

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is two users pick the same password?

A

A random number is added to the password, which will make the hash values different. this means that you will have to store the salt with the hash values.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

T/F: Hash function is fast, which makes it harder to crack.

A

False. Slow makes it difficult to crack via brute force.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Problem with passwords

A

–As password length and complexity increases, usability suffers–Phishing and social engineering take advantage of the face that users do not often authenticate who is asking for their password.–Once a password is stolen, it can be used many times.–Humans have a hard time remembering lots of passwords. Usable passwords are easy to guess.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Sys Admin

A

–Never store passwords in the clear–Only store hashed values and use a random salt–Avoid general purpose fast hash functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Users

A

–Use a password manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Something you have

A

User must have it. Token, smart cards, etc. Problems include: user must have it, additional HW may be required, increased cost.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Something you are

A

Biometric methods (ie keystroke dynamics, voice, retina scans, fingerprints)

22
Q

Static biometric methods

A

–Retina scans–Fingerprints–Face recognition

23
Q

Dynamic biometric methods

A

–Handwriting–Keystroke dynamics–Voice –Behavior

24
Q

Multi-factor authentication

A

Combination of the 3 factors:–Something you know–Something you have–Something you are

25
Q

Authentication over a network

A

–Remote services require authentication over a network. NOT a trusted path. Crypto helps.

26
Q

In a bio-metric scheme some physical characteristic of the individual is mapped into a digital representation. T/F

A

True

27
Q

User authentication is a procedure that allows communicating parties to verify that the contents of a received message have not been altered and that the source is authentic. T/F

A

False, message authentication

28
Q

Identification is the means of establishing the validity of a claimed identity provided by a user. T/F
False, Verification

A

False, Verification

29
Q

Depending on the application, user authentication on a bio-metric system involves either verification or identification. T/F

A

True

30
Q

Each individual who is to be included in the database of authorized users must first be _____ in the system.

A

Enrolled

31
Q

The _____ strategy is when users are told the importance of using hard to guess passwords and provided with guidelines for selecting strong passwords.

A

User Education

32
Q

Presenting or generating authentication information that corroborates the binding between the entity and the identifier is the _____.

A

Verification Step

33
Q

A _____ strategy is one in which the system periodically runs its own password cracker to find guessable passwords.

A

Reactive password checking

34
Q

What is Reactive Password Checking?

A

A strategy in which the system periodically runs its own password cracker to find guessable passwords.

35
Q

Recognition by fingerprint, retina and face are examples of _____.

A

Static biometrics

36
Q

In a _________ attack an application or physical device masquerades as an authentic application or device for the purpose of capturing a user password, pass-code or bio-metric.

A

Trojan Horse

37
Q

Objects that a user possesses for the purpose of user authentication are called _____

A

tokens

38
Q

An authentication process consists of the ________ step and the verification step

A

Identification

39
Q

What processes are part of the Authentication process?

A

Identification and Verification

40
Q

_______ in the context of passwords, refers to an adversary’s attempt to learn the password by observing the user, finding a written copy of the password, or some similar attack that involves the physical proximity of user and adversary.

A

Eavesdropping

41
Q

Voice pattern, handwriting characteristics and typing rhythm are examples of _______ bio-metrics.

A

dynamic

42
Q

What is the Identification step do?

A

Its presenting an identifier

43
Q

What does the Verification step do?

A

Proves you are who you say you are

44
Q

What is a Shadow Password File?

A

File where hashed passwords are saved separate from user id

45
Q

What does a Proactive password checker do?

A

Can’t make a password unless it is strong enough

46
Q

What is a Rainbow Table?

A

Large table of hash values of common passwords

47
Q

What is a “Salt”?

A

Random value added before hashing in case people pick the same passwords

48
Q

What are tokens for?

A

Something a user has used to identify and verify

49
Q

What are the two types of Biometrics? Provide examples of each.

A

Static: Always the same like fingerprint, iris..
Dynamic: Can be variable, voice recognition or handwriting

50
Q

What is a Replay attack?

A

Repeating a previously captured

user response

CS6035 - Intro to Info Sec (23 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions