Quick Tips Chapter 4: Access Control

Front 1

• Access is a flow of information between a subject and an object.

Back 1

• A subject is an active entity that requests access to an object, which is a passive
entity.

Front 2

• A subject can be a user, program, or process.

Back 2

• Confidentiality is the assurance that information is not disclosed to
unauthorized subjects.

Front 3

• Some security mechanisms that provide confidentiality are encryption, logical
and physical access control, transmission protocols, database views, and
controlled traffic flow.

Back 3

• Identity management solutions include directories, web access management,
password management, legacy single sign-on, account management, and
profile update.

Front 4

• Password synchronization reduces the complexity of keeping up with different
passwords for different systems.

Back 4

• Self-service password reset reduces help-desk call volumes by allowing users to
reset their own passwords.

Front 5

• Assisted password reset reduces the resolution process for password issues for
the help-desk department.

Back 5

• IdM directories contain all resource information, users’ attributes,
authorization profiles, roles, and possibly access control policies so other
IdM applications have one centralized resource from which to gather this
information.

Front 6

• An automated workflow component is common in account management
products that provide IdM solutions.

Back 6

• User provisioning refers to the creation, maintenance, and deactivation of
user objects and attributes, as they exist in one or more systems, directories, or
applications.

Front 7

• The HR database is usually considered the authoritative source for user
identities because that is where it is first developed and properly maintained.

Back 7

• There are three main access control models: discretionary, mandatory, and
nondiscretionary.

Front 8

• Discretionary access control (DAC) enables data owners to dictate what
subjects have access to the files and resources they own.

Back 8

• Mandatory access control (MAC) uses a security label system. Users have
clearances, and resources have security labels that contain data classifications.
MAC compares these two attributes to determine access control capabilities.

Front 9

• Nondiscretionary access control uses a role-based method to determine access
rights and permissions.

Back 9

• Role-based access control is based on the user’s role and responsibilities
within the company.

Front 10

• Three main types of restricted interface measurements exist: menus and shells,
database views, and physically constrained interfaces.

Back 10

• Access control lists are bound to objects and indicate what subjects can use
them.

Front 11

• A capability table is bound to a subject and lists what objects it can access.

Back 11

• Access control can be administered in two main ways: centralized and
decentralized.

Front 12

• Some examples of centralized administration access control technologies are
RADIUS, TACACS+, and Diameter.

Back 12

• A decentralized administration example is a peer-to-peer working group.

Front 13

• Examples of administrative controls are a security policy, personnel controls,
supervisory structure, security-awareness training, and testing.

Back 13

• Examples of physical controls are network segregation, perimeter security,
computer controls, work area separation, data backups, and cable.

Front 14

• Examples of technical controls are system access, network architecture,
network access, encryption and protocols, and auditing.

Back 14

• Access control mechanisms provide one or more of the following
functionalities: preventive, detective, corrective, deterrent, recovery, or
compensative.

Front 15

• For a subject to be able to access a resource, it must be identified, authenticated,
and authorized, and should be held accountable for its actions.

Back 15

• Authentication can be accomplished by biometrics, a password, a passphrase,
a cognitive password, a one-time password, or a token.

Front 16

• A Type I error in biometrics means the system rejected an authorized
individual, and a Type II error means an imposter was authenticated.

Back 16

• A memory card cannot process information, but a smart card can.

Front 17

• Access controls should default to no access.

Back 17

• Least-privilege and need-to-know principles limit users’ rights to only what is
needed to perform tasks of their job.

Front 18

• Single sign-on technology requires a user to be authenticated to the network
only one time.

Back 18

• Single sign-on capabilities can be accomplished through Kerberos, SESAME,
domains, and thin clients.

Front 19

• In Kerberos, a user receives a ticket from the KDC so they can authenticate to a
service.

Back 19

• The Kerberos user receives a ticket granting ticket (TGT), which allows him to
request access to resources through the ticket granting service (TGS). The TGS
generates a new ticket with the session keys.

Front 20

• Types of access control attacks include denial of service, spoofing, dictionary,
brute force, and wardialing.

Back 20

• Audit logs can track user activities, application events, and system events.

Front 21

• Keystroke monitoring is a type of auditing that tracks each keystroke made by
a user.

Back 21

• Audit logs should be protected and reviewed.

Front 22

• Object reuse can unintentionally disclose information.

Back 22

• Just removing pointers to files is not always enough protection for proper
object reuse.

Front 23

• Information can be obtained via electrical signals in airwaves. The ways to
combat this type of intrusion are TEMPEST, white noise, and control zones.

Back 23

• User authentication is accomplished by what someone knows, is, or has.

Front 24

• One-time password-generating token devices can use synchronous or
asynchronous methods.

Back 24

• Strong authentication requires two of the three user authentication attributes
(what someone knows, is, or has).

Front 25

• Kerberos addresses privacy and integrity but not availability.

Back 25

• The following are weaknesses of Kerberos: the KDC is a single point of failure;
it is susceptible to password guessing; session and secret keys are locally stored;
KDC needs to always be available; and there must be management of secret keys.

Front 26

• IDSs can be statistical (monitor behavior) or signature-based (watch for
known attacks).

Back 26

• Degaussing is a safeguard against disclosure of confidential information
because it returns media back to its original state.

Front 27

• Phishing is a type of social engineering with the goal of obtaining personal
information, credentials, credit card number, or financial data.

Back 27

• Phishing is a type of social engineering with the goal of obtaining personal
information, credentials, credit card number, or financial data.