Week 8 Flashcards
What does AAA stand for in ISM?
Authentication, Authorization, and Accountability.
What is authentication in information security?
Verifying the truth of an entity’s claimed identity.
What are the three main authentication factors?
Knowledge-based (e.g., password), Possession-based (e.g., smart card), Inherence-based (e.g., fingerprint).
What is multi-factor authentication (MFA)?
Using two or more authentication factors to increase security.
Give an example of MFA in a banking system.
Password + SMS OTP.
What is context-based authentication?
Authentication that considers environmental factors like location or device behavior.
What is risk-based authentication?
Authentication that adjusts based on perceived risk (e.g., high risk = MFA required).
Why is password hashing important?
It prevents attackers from retrieving original passwords if the database is leaked.
What does salting do in password storage?
Adds a random value to passwords before hashing to defend against rainbow table attacks.
What is the most secure method of password storage?
Hashed + salted + key stretching (e.g., using bcrypt or Argon2).
What are common user behaviors that weaken password security?
Reusing passwords, choosing weak passwords, writing them down.
What are examples of possession-based authentication methods?
USB keys, smart cards, authenticator apps.
What are the risks of biometric authentication?
Privacy issues and no fallback if compromised.
What is the difference between authentication and authorization?
Authentication verifies identity; authorization defines what actions the identity can take.
Name and describe the 4 access control models.
DAC: Object owner controls access (e.g., Google Drive).
MAC: Central authority assigns access based on labels (e.g., classified info).
RBAC: Based on roles in an organization (e.g., admin).
ABAC: Based on attributes like age or location (e.g., age-restricted sites).
What’s the difference between entities and identities in identity management?
Entities are real users/devices; identities are their system representations.
Why is identity management important in ISM?
It enables authentication, controls access, and supports accountability/auditing.
