Cissp- Chapter 2 Access Control

Front 1

List the three important characteristics of the mechanisms that are used for authentication:

Back 1

Subject must:
1) prove something he knows (Ex. password)
2) prove something he has (Ex. smart card)
3) prove something he is (Ex. Fingerprint)

Front 2

Define a Type I and a Type II error as it pertains to biometrics.

Back 2

Type I = a false reject rate, rejecting someone who should be authenticated.
Type II = a false accept rate, authenticating an imposter.
CER is the point at which Type I and Type II errors are the same.

Front 3

List the different types of Biometrics.

Back 3

1) fingerprints
2) finger scan
3) palm scan
4) hand geometry
5) retina scan
6) iris scan
7) signature dynamics
8) keyboard dynamics
9) voice print
10) facial scan
11) hand topology

Front 4

What is a cognitive password?

Back 4

A password based on fact or opinion used as the secret code, which is usually easier for the user to remember. Ex. What is your mother's maiden name? What is your dog's name?

Front 5

Define synchronous token devices.

Back 5

Uses a clocking mechanism agreed upon by token device and authenticating service. The token device presents encrypted time values users who enter the values with their username to be validated by the authentication service.

Front 6

What is an asynchronous token device?

Back 6

Uses a challenge-response method to create one-time passwords. The authentication service sends the user a value, which he enters into the token device. The device encrypts or hashes this value and gives it to the user. The user sends it to the authentication service for validation.

Front 7

What is a replay attack?

Back 7

Capturing a message, packet, or credential set and resubmitting it with the goal of impersonating a legitimate user.

Front 8

What is the difference between a smart card and a memory card?

Back 8

A memory card holds user credentials in a magnetic strip and relies on a reader to process the information (ATM card). A smart card has a processor chip on it and actually processes information.

Front 9

Name four kinds of single sign-on technologies:

Back 9

1) Directory Services (LDAP, AD, etc.)
2) SESAME
3) Kerberos
4) Thin clients

Front 10

Describe Kerberos:

Back 10

A user sends credemtial set to Kerberos which gives an encrypted ticket, the ticket is sent back validating user identity, and a session key is sent to both parties.

Front 11

Define SESAME:

Back 11

Secure European System for Applications in a Multi-vendor Environment. A single sign-on technology that is based upon Kerberos and improves upon it.

Front 12

Define DAC:

Back 12

Discretionary Access Control- owners of objects control who accesses them. Accsess is based entirely on the identity of the user or role a user plays within the company. ACLs are used.

Front 13

Define MAC:

Back 13

Mandatory Access Control (MAC) do not allow the access decisions to be made by data owners, instead a subject's clearance is compared to an object's classification. Every object has a security label (top secret, etc.)

Front 14

What is RBAC?

Back 14

Role-based Access Control- also called nondiscretionary models, make access decisions based on rights and permissions assigned to a role or group, not an individual. Ex. Active Directory Objects and groups.

Front 15

Define Content-Dependent Access Control:

Back 15

Used by databases. Uses lots of overhead and resources because each access request the db is scanned for content and then access granted or denied based on the subject's permissions.

Front 16

What is RADIUS and how does it authenticate users?

Back 16

RADIUS is Remote Authentication Dial-in User Service. Allows users to dial in over PPP or SLIP connections (modem or Internet). The access server is a middleman that accepts incoming calls, prompting the user for credentials and then passes them to the RADIUS server which verifies them by its database.

Front 17

What is TACACS+?

Back 17

Terminal Access Controller Access Control System - Similar to RADIUS, but is Cisco Proprietary and unlike RADIUS which only encrypts the user's password, TACACS encrypts the entire negotiation.

Front 18

What is TEMPEST?

Back 18

Standard for shielding (faraday cage) that allows for only an acceptable amount of radiation to escape from the system to avoid eavesdropping. White noise is another countermeasure for this, as well as control zones that use special rooms designed with special materials to block IR.

Front 19

What is a Man-in-the-Middle Attack?

Back 19

An intruder injects himself into an ongoing dialog between two computers so that he can intercept and read messages being passed back and forth.

Front 20

What is the Pin of Death?

Back 20

A type of DoS attack where an oversized ICMP packet or packets are sent to the victim causing it to freeze or reboot.

Front 21

List the five steps to Penetration Testing:

Back 21

1) Discovery
2) Enumeration
3) Vulnerability mapping
4) Exploitation
5) Report to Management

Front 22

Which of the following is the most important when evaluating different biometric systems?
A. Type I error
B. CER
C. Type II error
D. The total amount of errors between Type I and Type II

Back 22

B. Crossover error rate (CER) is the point in which Type I and Type II errors are equal and represents the most important rating for a biometric system.

Front 23

Which of the following access control models uses security labels?
A. Discretionary
B. Non-discretionary
C. Mandatory
D. Rol-based

Back 23

C. Mandatory access control models use security labels.

Front 24

Which of the following is a true statement pertaining to intrusion detection systems?
A. Signature-based systems can detect new attack types.
B. Signature-based systems cause more false positives than behavior-based systems.
C. Behavior-based systems maintain a database of patterns to match packets and attacks.
D. Behavior-based systems have higher false positives than signature-based systems.

Back 24

D. A behavior-based IDS learns about an environment and builds a profile. All future network activity is compared to the profile to try and uncover malicious events. A signature-based IDS maintains patterns of identified risks.

Front 25

Which of the following is a countermeasure to traffic analysis attacks?
A. Control zones
B. Keystroke monitoring
C. White Noise
D. Traffic Padding

Back 25

D. Traffic padding is the process of generating more traffic on the network to make it more difficult to monitor and analyze.

Front 26

Define object reuse:

Back 26

Several subjects access the same media or memory segments, causing sensitive data to become at risk of being uncovered. Leaving your data on the hard drive when throwing it away, etc.