Cissp Domain 2

Front 1

Access Control

Back 1

Security features that control how users and systems communicate and interact with other systems.

Front 2

Access

Back 2

The flow of information between subject and an object

Front 3

Subject

Back 3

An active entity that requests access to an object or the data within an object.

Front 4

Object

Back 4

A passive entity that contains information or needed functionality.

Front 5

Indentification

Back 5

A method of ensuring that a subject (user, program, or process) is the entity it claims to be.

Front 6

Authenicated

Back 6

The subject is usually required to provide a second piece to the credential set. This piece could be a password, passphrase, cryptographic key, personal indentification (PIN), anatomical attribute, or token.

Front 7

Authorize

Back 7

The system determines that the subject may have access to the resource

Front 8

Logical Access Controls

Back 8

Technical tools used for indentification, authenication, authorization, and accountability. They are software components that enforce access control measures for systems, programs, processes, and information.

Front 9

Race Condition

Back 9

when processes carry out their tasks on a shared resource in an incorrect order.

Front 10

Factors of Authenication

Back 10

Something a person knows, something a person is, something a person has.

Front 11

Strong Authenication.

Back 11

Uses two out of three factors of authentication.

Front 12

Identity Management

Back 12

A broad and loaded term that encompasses the use of different products to identify, authenicate, and authorize users through automated means.

Front 13

Access Control Review

Back 13

Identificaiton, authenication, authorization, accountability

Front 14

Directory Services

Back 14

Allows an administrator to configure and manage how identification, authenication, and access control take place within the network and on individual systems.

Front 15

namespace

Back 15

A method of keeping all of the directory service entities organized.

Front 16

Meta-directory

Back 16

Gathers the necessary information from multiple sources and stores it in one central directory.

Front 17

Virtual Directory

Back 17

Play the same roel and can be used instead of a meta-directory.The difference between the two is that the meta-directory physically has the identity data in its directory, whereas a virtual directory does not and point to where the actual data reside.

Front 18

Web Access Management Web Access Management (WAM)

Back 18

Software controls what users can access when using a web browser to interact with web-based enterprise assets.

Front 19

Password Synchronization

Back 19

Reduces the complexity of keeping up with different passwords for differents systems.

Front 20

Self-Service Password Reset

Back 20

Reduces help-desk call volumes by allowing users to reset their own passwords

Front 21

Assisted Password Reset

Back 21

Reduces the resolutions processfor password issues for the help desk. This may included authenication with other types of authenication mechanisms (biometrics, tokens)

Front 22

Legacy Sigle Sign-On

Back 22

Users products are commonly used as an IdM solution or as part of a larger IdM enterprise-wide solutions.

Front 23

Account Management

Back 23

Deals with creaing user accounts on all systems, modifying the account privileges when necessary, and decommissioning the accounts when they are no longer needed.

Front 24

Authoritative Source

Back 24

User information will be copied from the HR database

Front 25

Identity Repository

Back 25

When a user requests access to a resource, all of his identity data have already been copied from other identity stores and the HR database and held in this centralized directory.

Front 26

User provisioning

Back 26

The creation, maintenance, and deactivation of user objects and attributes as they exist in one of more systems, directories, or applications

Front 27

Self-service

Back 27

User profiles contain nonsenistive data that the user can update himself.

Front 28

Federate Identity

Back 28

A prtoable identity, and its associated entitlements, that can be used across business bounderies.

Front 29

Web Portals

Back 29

Parts of a website that act as a point of access to information. A portal presents information from diverse sources in a unified manner.

Front 30

portlets

Back 30

Pluggable user interface software components that present information from other systems.

Front 31

Service Provisioning Markup Language (SPML)

Back 31

allows for the exchange of provisioning data between application, which could reside in one organization or many.

Front 32

Security Assetion Markup Langauge (SAML)

Back 32

It is used when there is a need to allow a user to log in one time and gain access to different and separate web-based applications, the actual authen cation data have to be shared between the systems maintaining those web applications securely and in a standardized manner.

Front 33

Web Services

Back 33

a collection of technologies and standards that allow services to be provided on distributed systems and be "served up" in one place.

Front 34

Simple Object Access Protocol (SOAP)

Back 34

A specification that outlines how information pertaining to web services is exchanged in a structured manner. It provides the basic messaging framework, which allows users to request a service and, in exchange , the service is made available to the user.

Front 35

Service Oriented Architecture (SOA)

Back 35

A way to provide independent servies residing on different systems in different domains in one consistent manner.

Front 36

Extensible Access Control Markup Langauge (EACML)

Back 36

Used to express security policies and access rights to assets provided through web services and other enterprise applications.

Front 37

Biometrics

Back 37

Verifies an individual's identity by analyzing a unique personal attribute or behavior, which is one of the most effective and accurate methods of verifying identifications.

Front 38

TYpe I error

Back 38

false rejection rate

Front 39

Type II error

Back 39

False acceptance rate

Front 40

crossover error rate (CER)

Back 40

A percentage and represents the point at which the false rejection rate equals the false acceptance rate.

Front 41

Electronic Monitoring

Back 41

Listening to nework traffic to capture informatino, especially when a user is sending her password to an authenication server.

Front 42

Replay Attack

Back 42

The password can be copied and reused by the attacher at another time.

Front 43

Access the password file

Back 43

Usually done on the authenication server. The password file contains many users passwords end, if compromised, can be the source of the a lot of damage. This file should be protected with access control mechanisms and encryption.

Front 44

Brute Force Attacks

Back 44

Performed with tools that cycle through many possible character, number, and symbol combinations to uncover a password.

Front 45

Dictionary Attacks

Back 45

Files of thousands of words are compared to the user's password until a match is found.

Front 46

Social Engineering

Back 46

An attacker falsely convinces an individual that she has the necessary authorization to access specific resources.

Front 47

Rainbow table

Back 47

An attacker uses a table that contains all possible passwords already in a hash format.

Front 48

Password Checker

Back 48

Used to check the strength of a password

Front 49

Password hacker

Back 49

used to discover a password

Front 50

Cognitive Passwords

Back 50

Fact or opinion based information used to verify an individual's identity.

Front 51

One-time password

Back 51

Also called a dynamic password, it is used for authenication purposes and is only good once.

Front 52

The token device

Back 52

Usually a handheld device that has an CLD display and possibly a keypad.

Front 53

Sychronous token device

Back 53

Used with the authenication srvice by using time or a counter as the core piece of the authenication process.

Front 54

Asychronous

Back 54

A token device using an asychronous token-generating method employs a challenge/response scheme to authenicate the user.