CISSP - Domain 5

28 flashcards · Computer Science · by Jaysen Lewis

1. What is IAAA?

   Identification Hello, I am __________. Making unique identity CLAIMS Usernames, Access cards, ID Badges No proof is provided at this point! It's just a claim. Authentication Are you authentic? Proof of identity is provided here. Passwords, keys, tokens, MFA. Authorization Are you authorized? Whether you are allowed to access a system or object. ACLs Policies Accounting Keep people accountable. Non-repudiation. Tracking user activity Logs

2. What are some of the PROS with Biometric Authentication?

   Easy Enrollment (needs to be sub 2 min. to keep users happy) Low false acceptance & rejection rates Low intrusiveness (not as creepy)

3. What are the 4 steps of the Registration Process?

   1) Request 2) Approval 3) Identity Proofing 4) Issuance *** Separation of duties is very important with each step. Each step should be performed by a different person.

4. Which access control card is the easiest to duplicate without permission?

   Magnetic Stripe card

5. What type of AuthN error measures the frequency at which legitimate users are denied access to a system or facility?

   False Rejection Rate (FRR)

6. What type of AuthN error measures the frequency at which illegitimate users are allowed access to a system or facility?

   False Acceptance Rate (FAR)

7. What are the 3 different types of Authentication Factors? What constitutes as MFA?

   Something you KNOW Password, PIN, Security Question, UserID Something you ARE Biometric attribute, Fingerprint NOT Username Something you HAVE Physical/Soft Tokens, Smart Phone MFA App, Smart Card MFA is when you have multiple Authentication Factors combined; NOT 2 of the same type.

8. True or False? FAR and FRR are good measurements on their own.

   False. Solely relying on FAR or FRR data can lead to inaccurate or extreme measures for access control adjustments. You should instead use a Crossover Error Rate, which provides a balanced measure of strength. This is the efficacy rate that occurs when administrators tune the system to have equal/ tolerable false acceptance and false rejection rates.

9. What are the 2 different protocols for generating token codes?

   TOTP: Time-based OTP Uses time of day & a shared secret. Code changes constantly and is only valid until the next code change. The token and the authentication system must have synchronized clocks for TOTP to function correctly. HOTP: HMAC-based OTP Uses a shared secret and an incrementing counter to generate the code displayed on the token. The code changes whenever the button is pushed and the code is valid until it is used.

10. Know the different Password Authentication Protocols:

    PAP - Password Authentication protocol Insecure, Unencrypted (Requires External Encryption to protect passwords) CHAP - Challenge Handshake Authentication Protocol More secure alternative to PAP. Utilizes Challenge/Response & Hashes to authN Password is never sent over the network *** Microsoft also has MS-CHAP and MS-CHAPv2 but they are both broken & insecure.

11. What is the difference between Transitive and Non-Transitive Domain Trust:

    Transitive: Domain 1 will trust Domain 3 automatically because our already-trusted Domain 2 trusts Domain 3, without us having to really do anything. Non-Transitive: Domain 1 trusts Domain 2 but does not trust Domain 3, even if it is trusted by Domain 2 already.

12. What is Radius?

    RADIUS - Remote Access Dial-In User Service Allows many diverse applications to rely on the same source for AuthN Downsides: It uses UDP, unencrypted AuthN session. Exam tip: A RADIUS client is usually an application server. In the diagram below, the WAP is the RADIUS Client.

13. What is TACACS?

    TACACS - Terminal Access Controller Access Control System is an alternative to RADIUS Old versions TACACS & XTACACS are rarely used. TACACS+ is the current standard (dev'd by Cisco as a proprietary standard). PROS: TACACS+ uses TCP and is therefor connection-oriented. It is also encrypts the AuthN session.

14. What is one of the core protocols for AD?

    Kerberos

15. Know the Kerberos Logon Workflow:

    The Kerberos logon process works as follows: The user types username and password into the client. The client encrypts the username with AES for trans. to the KDC. The KDC verifies the username against a database of known credentials. The KDC generates a symmetric key, encrypts this with a hash of the user’s password. The KDC also generates an encrypted time-stamped TGT. The KDC then transmits both the encrypted symmetric key and the encrypted time-stamped TGT to the client. The client installs…

16. What TCP ports does Kerberos and LDAP use?

    Kerberos - 88 LDAP - 389 LDAPS - 636

17. What are the Downsides of NTLM?

    NT LAN Manager (NTLM) Older versions of NTLM use weak encryption that does not live up to modern standards Modern versions are Vulnerable to Pass-The-Hash Attack It is still used for backwards compat. but MS recommends disabling NTLM.

18. What is SAML?

    Security Assertion Markup Language WIdely used for SSO Benefits: SSO = good end-user experience. The service provider may use the identity providers authentication without gaining access to the user's password, which remains a shared secret between the user and the identity provider 3 Actors: Service Provider Principal (End-User) Identity Provider

19. What is the difference between OAuth and OpendID Connect (OIDC)?

    OAuth is an AuthZ protocol OpenID Connect (OIDC) is an AuthN protocl that works with OAuth.

20. In the Kerberos protocol, what system performs authentication of the end user?

    The Authentication Server (AS)

21. In SAML, what organization performs AuthN of the end user?

    The Identity Provider

22. There are two prerequisites for ensuring accountability and they are two of the fundamental requirements for any access control system. What are they?

    *** Secure Logging is also impoartant. Export those logs to a proper SIEM tool.

23. What is the least-invasive timeout mechanism for managed sessions?

    Screensavers

24. What are some of the common Account Management tasks?

    Implement Least Privilege Implement Separation of Duties Implement Job Rotation, Mandatory Vacations Manage the Account Lifecycle

25. What is Privilege Creep and how can it be mitigated?

    When a user accumulates excess permissions after shifting job responsibilities. Account Review/ Access Review process can help mitigate this.

26. Know the different Access Control types:

    DAC - Discretionary Access Control Object owners set the permissions for other users. Subjects (File Owners) have full control of objects they have created or been given access to. The most common access control. Lessens the burden on custodians. NTFS ACLs are a good example. MAC - Mandatory Access Control System/ OS enforced, based on subject's clearance & object's labels. Can be hierarchical. RBAC - Role Based Access Control Based on "role" of the subject SQL SSMS Roles are a good example (sy…

27. What are the different Access Control-related Attacks?

    Social Engineering attacks Intimidation, Authority, Consensus, Scarcity "I don't wanna miss out!" User Education/ Security Awareness is the solution Physical SE attacks: Shoulder-surfing, Dumpster diving, tailgating Use shredders, man-traps, screen privacy filters Impersonation attacks Spam Phishing Spear-Phising (more targeted) Whaling (targeted towards senior leaders) Pharming Starts with phishing Uses fake sites, typo squatting Vishing Voice Phishing over calls Smishing and SPIM Instant Mess…

28. What is Geotagging vs. Geofencing?

    Geotagging tags logs with user location Geofencing alerts admins to devices leaving defined boundaries.