Security+ Domain 3 - Access Control

Front 1

What is Implicit Deny?

Back 1

Default security stance that if you are not specifically granted access to a resource, you are denied access by default

Front 2

What is Least Privilege?

Back 2

Security stance that users are granted only the minimum necessary access, permissions and privileges that are required for them to do their job.

Front 3

What is the Bell La Padula model of Access Control?

Back 3

Intended to prevent unauthorized access to classified information. Prevents you from accessing information at a higher rating. If you can access secret, you can not access top secret and cannot write to any lower level than secret

Front 4

What is the Biba model of Access Control?

Back 4

Designed after Bell la Padula. More concerned with information integrity. Can't write up or read down. If you are assigned to top secret, you can't read secret. This keeps higher level information pure. Developed for industrial uses

Front 5

What is the Clark-Wilson model of Access Control

Back 5

Data can't be accessed directly. Accessed through applications that have predefined capabilities. Prevents unauthorized modifications, errors and frauds

Front 6

What is the Information Flow model of Access Control?

Back 6

Concerned with properties of information flow, not only the direction of the flow. Not just up and down flow. Each piece of information would have unique properties and the system would evaluate each request to read or right against the properties.

Front 7

What is the Noninterference model of Access Control?

Back 7

Higher level security functions don't interfere with lower level functions. Prevents lower level users from being able to deduce what changes are being made to system

Front 8

What is Mandatory Access Control (MAC)?

Back 8

A type of access control which is inflexible. All access capabilities are predefined based on set of rules based on sensitivity labels, security domains or classification.

Front 9

What is Discretionary Access Control (DAC)?

Back 9

Administrators have some flexibility about how information is accessed users can share info with others. Uses ACLs.

Front 10

What is Role Based Access Control?

Back 10

Roles based on job function or responsibility. Good for environments with high turn over rate.

Front 11

What is Rule Based access control?

Back 11

Preconfigured security policies make the decisions.

Front 12

What is Centralized Privilege Management?

Back 12

A single server or set of servers is responsible for managing, controlling and implementing all security access rights and privileges. Domain network and RADIUS authentication are examples.

Front 13

What is Decentralized Privilege Management?

Back 13

Each system is responsible for managing, controlling and implementing security controls, access rights, and privileges. Workgroup network is an example.

Front 14

What is an Access Control List (ACL)?

Back 14

Collection of usernames and group names with specific permission allow/deny assignments. Contains Access Control Entities (ACE).

Front 15

What are Group Policies?

Back 15

Allows centralized control and management over Windows client and server systems. Applied at startup.

Front 16

What is Password Policy?

Back 16

Both a set of rules written out as part of the organizational security policy that dictates the requirements of user and device passwords as well as a technical enforcement tool (typically part of the OS) that reinforces the password rules.

Front 17

What is Domain Password Policy?

Back 17

Password policy within a GOP that is applied throughout a MS AD domaine to all Windows domain members.

Front 18

What is RADIUS?

Back 18

Remote Authentication Dial-In User Service. Centralized authentication system which provides additional layer of security for networks. AAA server: Authentication, authorization and auditing. RADIUS server hosts the RADIUS service. The RADIUS client is the remote access server - not the remote system accessing the network.

Front 19

What is Remote Access Server (RAS)?

Back 19

Any server service that can connect to a remote system. RAS connection via dial up or network technologies such as VPN, ISPN, DSL and cable. Configure not to start automatically

Front 20

What is Lightweight Directory Access Protocol (LDAP)?

Back 20

Standardized access protocol, main access protocol used by AD.

Front 21

What is a Virtual Private Network (VPN)?

Back 21

Private network connection through public network. May be used to connect LANS over the internet. Typically use tunneling protocol L2TP, IPSec or point to point tunneling. PPTP offers some encryption, though weak. IPSec offer higher security. Provide access control, authentication, confidentiality, and data integrity.

Front 22

What is Kerberos?

Back 22

Symmetric key authentication protocol.
Uses Key Distribution Center (KDC). KDC authenticates the principal (user, program, system) provides with a ticket. Can be used to authenticate against other principals. Trusted third party authentication. Single sign on.
Weakness - KDC is single point of failure.

Front 23

What is Challenge Handshake Authentication Protocol (CHAP)?

Back 23

Challenges system to verify identity. Uses one way hash to protect passwords. Primarily over dialup connections (usually PPP). Periodically reauthenticates.

Front 24

What is Password Authentication Protocol (PAP)?

Back 24

Not true security, but simple form of authentication. Username and password sent to server in clear text

Front 25

What is Mutual Authentication?

Back 25

When 2 or more parties authenticate each other. Used for critical data transmissions. A client may authenticate to a server and a server to a client when need to establish secure connection.

Front 26

What is 802.1x?

Back 26

Port based authentication mechanism. Based on EAP commonly used in wireless networks. Vulnerable to man in the middle and hijacking attacks.

Front 27

What is TACACS?

Back 27

AAA server. Used to authenticate connections
Client server oriented environment
Operates like RADIUS, but uses TCP as opposed to UDP. Requires more bandwidth.
TACACS/+ allows credentials to be accepted from multiple methods including Kerberos.

Front 28

What is the difference between Identification and Authentication?

Back 28

Identification is the act of claiming an identity using just one authentication factor. Authentication is act of proving identity using one or more authenticator factors.

Front 29

What is Diameter?

Back 29

RADIUS implementation that deals with VoIP.

Front 30

What is the KDC used for?

Back 30

To store, distribute and maintain cryptographic session keys and secret keys. Also provides authentication services.

Front 31

What is EAP used for?

Back 31

Remote access Server can authenticate users with smart cards.

Front 32

What is TGT used for?

Back 32

Entity issued by the authentication service on the KDC to a principal. Proves principal identity thoughout the communication process.