Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

LIS 4774 > User Authentication > Flashcards

User Authentication Flashcards

1
Q

Presenting an identifier to the security system

A

Identification step

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Presenting or generating authentication information that corroborates the binding between the entity and the identifier

A

Verification step

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the four means of authenticating user identity based on?

A

Something the individual knows
Something the individual possess (token)
Something the individual is (static biometrics)
Something the individual does (dynamic biometrics)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an example of something the individual knows?

A

Password, PIN, answers to prearranged questions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is an example of something the individual possess?

A

Smartcard, electronic keycard, physical key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is an example of something the individual is (static biometrics)?

A

Fingerprint, retina, face

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is an example of something the individual does (dynamic biometrics)?

A

Voice pattern, handwriting, typing rhythm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are password vulnerabilities?

A 
Offline dictionary attack
Specific account attack 
Popular password attack
Password guessing against single user
Workstation hijacking
Exploiting user mistakes
Exploiting multiple password use
Electronic monitoring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

In the UNIX Hashed password scheme is the password saved on the machine?

A

no, only the user ID, salt value, and hash code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

True or False

Unix Hashed Password adequate or inadequate?

A

Now regarded as inadequate, still often required for compatibility with existing account management software or multivendor environments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the improvements implementations for the Unix Hashed Password Scheme?

A

Much stronger hash/salt schemes available for Unix
Recommended has function is based on MD5
OpenBSD uses Blowfish block cipher based hash algorithm call Bcrypt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are examples of password cracking?

A

Dictionary attacks
Rainbow table attacks
John the ripper

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the differences in memory card and smart card

A 
Memory cards
store but do not process data
Smart Card
Appearance of a credit card
Has an electronic interface 
Has an entire microprocessor
Processor
Memory 
I/O ports
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What does EEPROM stand for?

A

Electrically erasable programmable ROM

-Holds application data and programs on a smart card

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the two steps in an authetication process?

A

Identification step

Verification step

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Presenting an identifier to the security system

A

Identification step in the authentication process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Presenting or generating authentication information that corroborates the binding between the entity and the identifier

A

Verification step in the authentication process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

_______ is the means by which a user provides a claimed identity to the system.

A

Identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

_______ _____ ______ is the process of establishing confidence in user identities that are presented electronically to an information system.

A

Electronic user authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

An _______ _____ describes an organizations degree of certainty that a user has presented a credential that refers to his or her identity.

A

assurance level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the four levels of assurance and there levels of confidence?

A

Level 1: little or no confidence
Level 2: Some confidence
Level 3: High confidence
Level 4: Very high confidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

An authentication error could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

A

Low Potential Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

An authentication error could be expected to have a serious adverse effect.

A

Moderate Potential Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

An authentication error coulee be expected to have a severe or catastrophic adverse effect.

A

High Potential Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How does an ID provide security?

A
  • It determines whether the user is authorized to gain access to a system.
  • Determines the privileges accorded to the user.
  • Is used in what is referred to as discretionary access control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

The attacker obtains the system password file and compares the password hashes against hashes of commonly used passwords.

A

Offline dictionary attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

The attacker targets a specific account and submits password guesses until the correct password is discovered.

A

Specific account attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

A variation of the preceding attack is to use a popular password and try it against a wide range of user IDs.

A

Popular password attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

The attacker attempts to gain knowledge about the account holder and system password policies and uses that knowledge to guess the password.

A

Password guessing against single user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The attacker waits until a logged-in workstation is unattended.

A

Workstation hijacking

31
Q

If the systems assigns a password, then the user is more likely to write it down because it is difficult to remember. This situation creates the potential for an adversary to read the written password

A

Exploiting user mistakes

32
Q

Attacks can also become much more effective or damaging if different network devices share the same or a similar password for a given user.

A

Exploiting multiple password use

33
Q

If a password is communicated across a network to log on to a remote system, it is vulnerable to eavesdropping.

A

Electronic monitoring

34
Q

What is the process of using a Hashed Password when loading a new password into the system.

A
  1. The user selects or is assigned a password.
  2. The password is combined with a fixed-length salt value.
  3. The password and salt serve as inputs to a hashing algorithm to produce a fixed-length hash code.
  4. The User ID, Salt value, and Hashed password are then stored in the password file.
35
Q

What is the process of using hashed passwords when logging onto a Unix system.

A
  1. User provides their ID and password
  2. The OS uses the ID to index into the password file and retrieve the plaintext salt and the encrypted password.
  3. The salt and user-supplied password are used as input to the encryption routine.
  4. If the result matches the stored value, the password is accepted.
36
Q

What are the three purposes that salt serves in hashed passwords.

A
  1. It prevents duplicate passwords from being visible in the password file.
  2. Increases the difficulty of offline dictionary attacks.
  3. Impossible to find out whether a person with passwords on two or more systems has used the same password on all of them.
37
Q

What are the two threats to the UNIX password scheme?

A
  1. A user can gain access on a machine using a guess account or by some other means and then run a password guessing program.
  2. If an opponent is able to obtain a copy of the password file, then a cracker program can be run on another machine at leisure.
38
Q

To develop a large dictionary of possible passwords and to try each of these against the password file.

A

Password cracking

39
Q

An attacker generates a large dictionary of possible passwords. For each password, the attacker generates the hash values associated with each possible salt value. The result is a mammoth table of hash values known as a ______ ______.

A

rainbow table.

40
Q

Attacks that use a combination of brute-force and dictionary techniques have become common.

A

A notable example of this dual approach is John the Ripper, an open-source password cracker first developed in 1996 and still in use.

41
Q

What are the two improvements that password-cracking has endured to keep pace with strong password requirements.

A
  1. The processing capacity available for passwords cracking has increased dramatically.
  2. The use of sophisticated algorithms to generate potential passwords.
42
Q

The hashed passwords are kept in a separate file from the user IDs, referred to as a ______ ______ ____.

A

shadow password file

43
Q

What are the vulnerabilities in password file protection?

A
  1. Many systems are susceptible to unanticipated break-ins
  2. An accident of protection might render the password file readable.
  3. Some users may have accounts on other machines in other protection domains, and use the same password
  4. A lack of or weakness in physical security
  5. Sniffing network traffic to find user IDs and passwords.
44
Q

What are the four password selection strategy techniques?

A

User education
Computer-generated passwords
Reactive password checking
Complex password policy

45
Q

Users being informed of the importance of using hard-to-guess passwords and can be provided with guidelines for selecting strong passwords.

A

User education

46
Q

A random number generator produces a random stream of characters used to construct the syllable and words.

A

Computer-generated passwords

47
Q

A strategy in which the system periodically runs its own password cracker to find guessable passwords.

A

Reactive password checking

48
Q

In this scheme, a user is allowed to select his or her own password. However, at the time of selection, thy system checks to see if the password is allowable and, if not, rejects it.

A

Complex password policy

or proactive password checker.

49
Q

True or False

A magnetic stripe can store only a simple security code, which can be read by an inexpensive card reader.

A

True

50
Q

Define the card type Embossed Feature and provide an example.

A

Passed characters only, on front; old credit card

51
Q

Define the card type Magnetic stripe Feature and provide an example.

A

Magnetic bar on back, characters on front; Bank card

52
Q

Define the card type Memory Feature and provide an example.

A

Electronic memory inside; Prepaid phone card

53
Q

Define the card type Smart Contact Contactless Feature and provide an example.

A

Electronic memory and processor inside, Electrical contacts exposed on surface, Radio antenna embedded inside; Biometric ID card

54
Q

What are the potential draw backs of using a memory card?

A

Requires special reader
Token loss
User dissatisfaction

55
Q

What are the three categories of authentication protocols used with smart tokens?

A

Static
Dynamic password generator
Challenge-response

56
Q

What human-readable data does an eID have printed on it? German card neuer Personalausweis

A

Personal data
Document number
Card access number (CAN)
Machine readable zone (MRZ)

57
Q

What is an eID?

A

Electronic Identity Card

58
Q

This function is reserved for government use and stores a digital representation of the cardholder’s identity.

A

ePass

Mandatory

59
Q

The ____ function stores an identity record that authorized service can access with cardholder permission.

A

eID

Activation Optional

60
Q

This optional function stores a private key and a certificate verifying the key; it is used for generating a digital signature.

A

eSign

61
Q

_______ ensures that the contactless RF chip in the eID card cannot be read without explicit access control.

A

Password Authenticated Connection Establishment (PACE)

62
Q

What are the physical characteristics used in biometric applications.

A 
Facial characteristics 
Fingerprints 
Hand geometry 
Retinal pattern 
Iris 
Signature 
Voice
63
Q

What is biometric verification?

A

The user enters a PIN and also uses a biometric sensor.

64
Q

What is biometric identification?

A

The individual uses the biometric sensor but does not present any additional information.

65
Q

For a given biometric scheme, we can plot the false match versus false non match rate, called the ______ _______ _____.

A

operating characteristic curve

66
Q

A user first transmits his or her identity to the remote host. The host generates a random number r, often called a _____, and returns it to the user

A

Nonce

67
Q

What are attacks that remotely user authentication face?

A 
Client attack 
Host attack 
Eavesdropping, theft, and copying
Replay
Trojan horse
Denial of service
68
Q

An adversary attempts to achieve user authentication without access to the remote host or to the intervening communications path. The adversary attempts to masquerade as a legitimate user.

A

Client attacks

69
Q

Attacks that are directed at the user file at the host where passwords, token passcodes, or biometric templates are stored.

A

Host attack

70
Q

Adversaries attempt to learn the password by observing the user, finding a written copy of the password.

A

Eavesdropping

71
Q

Attacks involve an adversary repeating a previously captured user response.

A

Replay

72
Q

An application or physical device masquerades as an authentic application or device for the purpose of capturing a user password, passcode, or biometric.

A

Trojan horse

73
Q

An attack that attempts to disable a user authentication service by flooding the service with numerous authentication attempts.

A

Denial-of-service

LIS 4774 (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions