Cissp Domain 5 - Identity And Access Management (Steve)

Front 1

In Access control, what are the 3 general control types?

Back 1

1. Administrative (Management)
2. Technical (Logical/Administrators)
3. Physical

Front 2

Regarding access control, what are:

Subject, Object, Access, Access Control?

Back 2

Subject: entity requesting access
Object: passive entity containing information
Access: ability to interact or "do something"
Access Control: security features that control subject/object interactions

Front 3

Access can be controlled by a __________ or a ______

Back 3

System, Facility

Front 4

What are the steps of subject's access control?

Back 4

1. Subject ID

2. Subject Authentication

3. Authorization to interact

4. Log

Front 5

Regarding Account Management, what is the central repository, and what standard does it use?

Back 5

LDAP (Lightweight Directory Access Protocol), x.500

Front 6

What is the most common system used for authentication?

Back 6

passwords

Front 7

What is clipping or a clipping level?

Back 7

An administrator can set operating parameters that allow a certain number of failed logon attempts to be accepted before a user is locked out

Front 8

Who published X.500?

Back 8

ISO

Front 9

_______ adapts the x.500 directory to work over TCP/IP

Back 9

LDAP

Front 10

What starts authentication of a user?

Back 10

User or system claims identity (Step 1)

Front 11

LDAP is a ____________ type structure. The Distinguished Name or ________ must be unique.

Back 11

Tree, Leaf

Front 12

What is the system that is most commonly used for Single Sign on?

Back 12

Kerberos

Front 13

What is Kerberos?

Back 13

A Single Sign on Technology

Authentication server authorizes user to request ticket.
Ticket granting services (TGS) issues secure time-stamped ticket.
Subject shows ticket to object to request access (based on an ACL.)

Front 14

Kerberos Server is called _________________ (KDC) and is a _________ authentication technology for "realms".

Back 14

Key Distribution Center, ticket-based

(NOT PKI!!!)

Front 15

In Kerberos, what does the Authentication Server (AS) do?

Back 15

authorizes user to request ticket

Front 16

In Kerberos, what does TGS (Ticket Granting Service) do?

Back 16

secures and issues tickets to authenticated users

Front 17

In Kerberos, what is a defined area?

Back 17

A Realm

Front 18

In Kerberos, a ________ is shown by a Subject to an Object in the defined realm to request access.

Back 18

ticket

Front 19

What do Europeans use for single sign on? (Instead of Kerberos)

Back 19

SESAME (Secure European System for Applications in a Multi-vendor Environment)

Front 20

What are the four types of authentication?

Back 20

1. something you are

2. something you have

3. something you are

4. somewhere you are (such as an IP address)

Front 21

CAPTCHA is an example of?

Back 21

Graphical Interpretation which can be read by humans, but not machines.

Front 22

What is a token pin device?

Back 22

Small token generating device. Coupled with a password for entry. (SecureID)

Front 23

What is it called when a user enters a value and PIN, then is given a new value to enter by a token device?

Back 23

Challenge-response scheme (One-Time Password) OTP

Front 24

What is micro-probing?

Back 24

An attack on smart cards

Front 25

In biometrics, what are type 1 and type 2 errors?

Back 25

Type 1: False Reject rate (FRR)

Type 2: False Accept Rate (FAR)

Front 26

Biometrics can be 1:1 or 1:many. What does that mean?

Back 26

1:1 - user is identified against specific criteria

1:many - user is identified against large database of possibilities

Front 27

Which is more secure, retina or iris scanning?

Back 27

Retina. (Iris is cheaper)

Front 28

During authorization, which comes first, authorization or authentication?

Back 28

Authentication.

Front 29

___________ is the process of comparing a subject's credentials and permissions to an access criteria.

Back 29

Authentication

Front 30

According to User Session Management, what is a good practice after user locks computer. What is the system vulnerable to, if not.

Back 30

Need to re-authenticate when logging back in. TOC/TOU attack.

Front 31

Regarding wireless networking, what are the three types of authentication?

Back 31

1. Open system (no password) (cafes)

2. Pre-shared key (WEP or WPA) (hotels)

3. Enterprise (meaning individual authorization/passwords) (work)

Front 32

What are the two wireless networking Enterprise level password/authentication servers?

Back 32

RADIUS, TACACS (Authenticate remote users; also for VPN)

Front 33

What is Leeching?

Back 33

Stealing access to a WAP. Still an issue with WPA and WPA2

Front 34

What are Rogue access points (evil twins)?

Back 34

They are unauthorized WAPs.

Front 35

IEEE802.1x Enterprise authentication, authenticates individual users with ____________.

What protocol extends the strength of the authentication?

Back 35

MSCHAP (Microsoft Challenge Handshake Authentication Protocol),

EAP (Extensible Authentication Protocol)

Front 36

What is the most popular use of EAP (Extensible Authentication Protocol)?

Back 36

PEAP (Protected Extensible Authentication Protocol)

Front 37

What is MSCHAPV2?

Back 37

The most common use of CHAP.

Front 38

IEEE802.1x is ________-based security

Back 38

Port

Front 39

Regarding access controls, what does AAA =?

Back 39

Authentication, Authorization and Auditing

(e.g. RADIUS, Kerberos, TACACS+

Front 40

What is the authentication protocol that was originally used for dial-up, but now primarily for wifi and VPN?

Back 40

RADIUS (Remote Authentication Dial-in User Service)

Front 41

What is another name for a user in RADIUS systems?

What does the "client" do?

Back 41

Supplicant, forwards credentials to RADIUS server

Front 42

What is the big difference between RADIUS and TACACS?

Back 42

TACACS is more secure, as it uses PKI credentials to protect data traffic. (RADIUS does not)

Front 43

Which is more secure, Kerberos or RADIUS?

Back 43

Kerberos

RADIUS can send unprotected data, unless using the local (user-created) encryption key.

(Note: not as secure, because encryption key is permanent until changed)

Front 44

MSCHAP is good, but it only supports hashed passwords for authentication. If you want stronger authentication, you need either ________ or _________.

Back 44

EAP or PEAP

Front 45

In 802.1x (Port based Security), the __________ requests access from the Client. Then, the client uses _____ to send back a challenge. The challenge (username/password) is then sent by the client to the _________ for authentication.

Back 45

Supplicant, CHAP or EAP, Authentication Server

Front 46

Nextgen RADIUS is called __________?

Back 46

DIAMETER

Front 47

What authentication is used below?

1. Telecommuters using VPN:

2. Site to Site VPN (Routers or conentrators):

3. Telecommuters browser:

4. Dial-Up

Back 47

1. L2TP / IPSec

2. L2TP / IPSec

3. Browser/TLS - MSCHAPV2

4. CHAP

Front 48

Networks may have ______________ technology that authenticates system "health" before they are allowed access to the network

Back 48

Network Access Control (NAC)

Front 49

These 2 products gather logs from various devices (servers, firewalls, routers, etc.) and attempt to correlate the log data and provide analysis capabilities.

Back 49

SIEM (Security Information and Event Management) and SEM (Security Event Management)

Front 50

____________ is a new system for near real-time threat notification of logged security violations.

Back 50

SIEM (Security Information Event Management)

Front 51

______products are similar to IDS, but they generate alerts based on analysis of log data generated by various systems.

Back 51

SIEMs

Front 52

This is a best practice that is performed on monitored objects to see the results of the action. (a system or reaction test of sorts)

Back 52

Synthetic Transaction

Front 53

Utilizing cloud based access control, what is IDaaS?

Back 53

(IDaaS) Identity as a Service. Hiring a trusted third party to aid in managing identification and authentication of subjects.

Front 54

What provides: Single Sign On to access cloud services, uses Federated Identity (tokenization) and centrally managed controls that are transparent to users?

Back 54

Identity as a Service (IDaaS)

Front 55

In IDaas, _____________ shares only a token with the IDaaS agent.

Back 55

Active Directory (AD)

Front 56

What is Federated Identity?

Back 56

It is used to implement Single Sign On (SSO) using browsers. only passes tokens to outside systems. (number, not username - passes no PII)

Front 57

What is SAML (Security Assertion Markup Language)?

Back 57

(SAML) This is the language used to exchange the assertion tickets)

Allows for the exchange of authentication and authorization data to be shared between security domains. It is an XML web-based standard.

(No PKI Trust between disparate systems)

Front 58

In Federated Identity Management, what does IdP (Identity Provider) control?

Back 58

The user database, called the credential store

Front 59

What is OAuth 2.0?

Back 59

An authorization framework giving limited access to HTTP.

Not a physical token, but numeric ID.

(Baaaaad)

Front 60

In Centralized Access Control, what are the 4 main models (frameworks that dictate how subjects interact with and access objects)

Back 60

DAC, MAC, Rule-BAC, Role-BAC

Front 61

What is DAC?

Back 61

Discretionary Access Control (DAC) - Data owner/creator specifies who can access resources.

Inappropriate for corporate environment.

Commonly used with SharePoint

Front 62

What is MAC?

Back 62

Mandatory (Military) Access Control (MAC) - Lattice-based inflexible model utilizes security labels (Bell La Padula)

Used for Classified data

Front 63

What is Role-Based Access Control?

Back 63

Allows access to objects based on the single role of a user (such as a doctor in a hospital). Users are assigned to roles. Rights are assigned to roles.

Separation of duties

Front 64

What is Rule-Based Access Control?

Back 64

Dynamic model based on if/then evaluation against a rule set (such as an ACL)

Like Routers & L3 switches based on VLAN Tags

Front 65

Difference between Content and Context dependent access control?

Back 65

Content (Static - based on content within the object)

Context (access determined by sequence of events that preceded access attempt)

Front 66

In Access Control Administration,

1. What is Centralized Access Control?

2. What is decentralized Access Control?

3. What is Hybrid Access Control?

Back 66

1. One entity controlling provisioning and access management.

2. Control given to people closer to resource

3. Combination of both of the above

Front 67

What is Pass The Hash?

Back 67

Bad guy steals and reuses hashes. (replay)

Front 68

What type of access control is utilized by Bell La Padula? (used by DoD)

Back 68

Mandatory Access Control (MAC)

Front 69

What is the most common log storage solution?

Back 69

Syslog

Front 70

What are the following Access Provisioning Models?

1. Role Based

2. Request Based

3. Hybrid

Back 70

1. automatic based on user's role

2. starts from scratch based on mgrs request (supports DAC and MAC)

3. combination of the above

Front 71

What are the 3 steps in Identity and Access Provisioning Lifecycle?

Back 71

1. Provisioning

2. Review

3. Revocation