Security & Access Management Flashcards
SPF
Sender Policy Framework
- Email authentication method designed to detect forging sender addresses during the delivery of the email
- Limited to detecting a forged sender claim in the envelope of the email
DAC
Discretionary Access Control
An access control model where all objects (files and folders) have owners and owners can modify permissions for the objects.
MS NTSF uses the DAC model.
MAC
Mandatory Access Control
- Non-discretionary access control policy where the computer system (vs. owner) determines the access control for an object
- Uses labels (sometimes referred to as sensitivity labels or security labels) to determine access
- Security administrator assign labels to subjects (users) and objects (files folders devices or network connection)
- When the labels match the system can grant a subject access to an object.
- When the labels don’t match access is blocked
- Data labels create trust levels for all subjects and objects
- Implemented through the Rule-based and Lattice-based access control methods.
MFA
Multifactor Authentication
Type of authentication that uses methods from more than one factor of authentication.
CSO
Chief Security Officer
The executive responsible for an organization’s entire security posture both physical and cyber and has the big picture view of the company’s operational risk.
Similar to ISSO and generally reports to the CIO.
SSO
Single Sign-On
- Ability of user to logon or access multiple systems by providing credentials only once
- Increases security because user only needs to remember one set of credentials and is less likely to write them down
RBAC/Rule-BAC
Rule-Based Access Control (AKA Rule-BAC)
- Access is controlled by a set of approved instructions (rules) such as an access control list (ACL)
- Rules can be parameters such as allowing access only from certain IP addresses or denying access from certain IP addresses or something more specific.
- Some systems use rules that trigger a response to an event such as the response to an attack or situation where a user needs additional permissions
ID
Identification
An assigned user identifier (ID) to a human being or other system user.
EER
Equal Error Rate
A statistic used to show biometric performance, typically when operating in the verification task.
The EER is the location on a ROC or DET curve where the false acceptance rate and false rejection rate are equal.
The lower the EER value, the higher the accuracy of the biometric system.
AAA
Authentication, Authorization, & Accounting
A common security framework for mediating network and application access.
- Authentication - verifies access
- Authorization - determines if a user should have access
- Accounting - tracks access with logs
RBAC/Role-BAC
Role-Based Access Control
- Uses roles to manage rights and permissions of users
- Users are assigned to roles and network objects are configured to allow access only to specific roles
- Roles are created independently of user accounts
- Model is used by the majority of enterprises with 500+ employees.
HSM
Hardware Security Module
A removable or external device that can generate store and manage RSA keys used in asymmetric encryption.
Compare with TPM.
FRR
False Rejection Rate
A metric for biometric devices that describes the percentage of authorized users who were incorrectly rejected by a biometric system.
CAC
Common Access Card
A specialized smart card used by DOD.
It includes photo identification and that provides confidentiality, integrity, authentication, and non-repudiation.
HOTP
HMAC-based One-Time Password
- An open standard for creating one-time passwords.
- It combines a secret key and a counter and then uses HMAC to create a hash of the results.
- Generates a one-time password using a hash-based authentication code to verify the authenticity of the message.
- AKA event-based one-time password
