Cissp-Domain 2-Access Control

Front 1

Collection of mechanisms that work together to protect the assets of the enterprise
-most prevasive and omnipresent aspect of information security

Back 1

Access Control(s)

Front 2

Access controls apply to:

Back 2

Facilities, Support systems, information systems, personnel-mgmt,users,customers,business partners

Front 3

Access controls enable management to:

Back 3

1)Specify which users can access a system
2)Specify what resources they can access
3) Specify what operations they can perform
4) Provide individual accountability

Front 4

T/F each new user or community increases the threat profile of an org

Back 4

True

Front 5

What identifies what resources are necessary for a person to access (Determining Resources)?

Back 5

The user's role

Front 6

Specifying use determines

Back 6

level of authorization

Front 7

the ability for the organization to hold people responsible for their actions

Back 7

Individual accountability

Front 8

A comprehensive access control strategy will include

Back 8

the monitoring and secure logging of identification, authentication, and authorization processes and accountability of user actions and attempted actions by auth'd users w/o privs

Front 9

What is the first element of access control?

Back 9

to establish an access control policy

Front 10

Access Control policy does what?

Back 10

specifies how users are id'd, auth'd, and level of access granted to resources

Front 11

Which privs users will be given to access resources will be specified where?

Back 11

Access Control policy

Front 12

The access control policy is usually based on what two standards of practice?

Back 12

1) Separation of duties
and
2) least privilege
*also sensitivity of data

Front 13

Primary objective of separation of duties? (ie disseminating taks ans associate privileges for specific process among multiple users)

Back 13

Prevention of fraud and errors

Front 14

first action req'ed to employ separation of duties:

Back 14

Defining elements of a process or work function

Front 15

Second step of employing separation of duties:

Back 15

divide elements of a work function among different users or roles w/in a function

Front 16

When is static separation of duties used?

Back 16

when the assignment of individuals to roles and work functions element to roles is possible

Front 17

When is dynamic separation of duties used?

Back 17

When compliance w/ reqts can only be determined during system operation. *allows more flexibility

Front 18

What are the two factors to be addressed when determining applicability of separation of duties?

Back 18

1) sensitivity of the function
2) available process that lend themselves to distribution

Front 19

Element distribution is broken down to what 3 parts?

Back 19

1) Element identification, importance, criticality (potential for abuse)
2) Operational Considerations
3) User skills and availability

Front 20

What is described by "requires that a user or process be given no more privilege than necessary to perform a job"

Back 20

least privilege

Front 21

Practice of evaluation the risk level of the organization's information to ensure that the information receives the appropriate level of protection

Back 21

Information Classification

Front 22

What are the steps for establishing and sustaining a data classification process?

Back 22

1) Determine data classification project objectives
2) Establish organizational support
3) Develop data classifcation policy
4) Develop data classification standard
5) Develop data classification process flow and procedure
6) Develop tools to support process
7) Identify application owners
8) Identify data owners and data owner delegates
9) Distribute standard templates
10) Classify information and applications
11) Develop auditing procedures
12) Load informatino into central repository
13) Train users
14) Periodically review and update data classifications

Front 23

Benefits of data classication

Back 23

increases CIA
Improved workflow
Reduction in costs of overprotection
Ability for managers to enforce accountability
Protection of departmental intellectual property/trade secrets

Front 24

Communicates req't to classify info and the purpose of data classification

Back 24

Data Classification Policy

Front 25

Communicates how to determine classification of a particular information item

Back 25

Data classification standard

Front 26

Levels of data classification

Back 26

Public (unclassified)
Internal Use Only
Confidential
(optional higher level)

Front 27

What data classification level required no special protections?

Back 27

Public (unclassified)

Front 28

Information that could harm the company if disclosed externally (e.ge. customer lists, vendor pricing, organizational policies, standards & procedures)

Back 28

Internal use only

Front 29

Information that if released outside of the org would create sever problems for the org (ie. trade secrets, IP, research design, payroll info, health records, sr mgmt correspondence, business plans)

Back 29

Confidential

Front 30

Six main access control categories (characteristics of Access Control categories):

Back 30

1) Preventive - avoid incident
2) Deterrent - discourage incident
3) Detective - identify incident
4) Corrective - remedy circumstance/mitigate damage and restore controls
5) Recovery - restore conditions to normal
6) Compensating - alternative control (e.g. Supervision)

Front 31

Three types of access control

Back 31

1) Administrative
2) Physical
3) Technical

Front 32

What type of access control defines the roles, responsibilities, policies...?

Back 32

Administrative

Front 33

What type of access control is the nontechnical environment, such as locks, fire management, gates and guards?

Back 33

Physical

Front 34

What type of access control encompasses the electronic controls as the personification of the control environment?

Back 34

Technical

Front 35

Aspects of Administrative access control

Back 35

Operational policies and procedures,
Personnel security, evaluation and clearances,
Security policies,
Monitoring
User management,
Privilege management

Front 36

Change control, business continuity and disaster recover, performance, configuration management, vulnerability management, product life-cycle management, network management are all examples of which aspect of Administrative access control

Back 36

Operational policies and procedures

Front 37

the administrative tasks performed on a system or device to ensure optimal operations.

Back 37

Configuration Management

Front 38

Establishing security reqts and validating individuals to bobtain credentials are part of which aspect of Administrative Controls

Back 38

Personnel security, evaluation and clearances

Front 39

Access Control policy should consider:

Back 39

-Security reqts of individual enterprise apps, systems and services
-statements of info dissemination & authorization, such asleast privilege, data classification and specified controls for access,
-The consistency between the access control and information classificiation policies of different systems and networks
-Contractual obligations or regulatory compliance regarding protection of assets
-standards defining user access profiles for organizational roles

Front 40

Contractual obligations or regulatory compliance regarding protection of assets

Back 40

standards defining user access profiles for organizational roles

Front 41

Best approach to ensuring consistency and control in password management is:

Back 41

1)Clearly defined policies
2) Well-implemented system controls
3) Understanding of the technical considerations
4) Comprehensive user training
5)Continual auditing

Front 42

Physical security is based on

Back 42

Zones, concentric areas within a facility, that require access

Front 43

What is priority in all decision of physical security?

Back 43

Human safety

Front 44

mechanisms employed within the digital infrastructure that enforces policy

Back 44

Technical Access Control

Front 45

Types of technical access controls

Back 45

1) User controls
2) Network access
3) Remote access
4) System Access
5) Application access
6) Malware control
7) Encryption

Front 46

ACLs, remote-access solutions, VLANs, protocols, firewalls, and IDSs are examples of which technical access control type

Back 46

Network access

Front 47

what is an example of a network access control that increases the level of access management in the environment?

Back 47

proxy servers

Front 48

What is used to segment traffic and limit the interaciton form one network to another?

Back 48

VLAN

Front 49

Cisco clean access is an example of

Back 49

network access Technical access control

Front 50

VPNs are example of which technical control

Back 50

remote access

Front 51

File system is an example of which technical control

Back 51

System Access

Front 52

buffer overflows that potentially allow malicious activity circumvent which type of technical control?

Back 52

System Access

Front 53

time-outs, data entry validation, and limiting access to specific service or modules based on user rights and needs are examples of which type of technical control?

Back 53

Application Access

Front 54

Controls within application access control include what:

Back 54

user activity, internal service, and data service..inter-process sharing/privs

Front 55

Antivirus, IPSs are what type of technical control

Back 55

Malware control

Front 56

Encryption can be used to ensure the:?

Back 56

confidentiality of information and authenticate information integrity

Front 57

most predominant aspect of crypto in access control is?

Back 57

employment of cryptographic mecahnisms to ensure the integrity of authentication protocols & processes

Front 58

Threats to access control and CIA

Back 58

DoS, Buffer overflows, mobile code, malicious code, malware, password crackers, spoofing, sniffers, emanations, shoulder sufing, tapping, object reuse, data remnants, onauthorized targetted daata mining, dumpster diving, backdoor,theft, intruders, social engineering

Front 59

teardrop attack

Back 59

DoS attack using overlapping fragmented datagrams

Front 60

Buffer overflow errors can be due to:

Back 60

1) poor coding
2) Errors in the system BIOS

Front 61

s/w transmitted across a network from a remote source to a local system ad is then executed

Back 61

mobile code (e.g. Active X, java applets, scripts)

Front 62

Malicious mobile code represents a failure of which technical control?

Back 62

Application controls

Front 63

software, applications, applets, scripts, or any digital material that performs undesirable functions

Back 63

Malicious software

Front 64

Parasitic code that req's human transferral or insertion, or attaches itselft to another program to facilitate replication

Back 64

Virus

Front 65

self-propagating code that exploits system or application vulnerabilities

Back 65

Worm

Front 66

John the Ripper and L0phtcrack are?

Back 66

password crackers

Front 67

rainbow chains/tables, introduced by Phillippe Oechslin was an improvement over whose previous techniques of password cracking

Back 67

Rivest-1982-distinguished points at the ends of chains
Martin Hellman-1980-time-memory tradeoff precalculated data stored in memory

Front 68

who popularized IP spoofing

Back 68

Kevin Mitnick

Front 69

example of emanations are:

Back 69

wireless wi-fi, electromagnetic loos from comm lines, computer monitors, bluetooth-enabled devices, sound propagation

Front 70

three type of antenna propagation

Back 70

1) omnidirectional 2) semidirectional 3) highly directional

Front 71

Name one defense against shoulder surfers

Back 71

screen filters

Front 72

allocation or reallocation of system resources to an unauthorized user or , more appropriately to an application or process

Back 72

Object reuse

Front 73

Two aspects of object reuse:

Back 73

1) direct employment of the object
2) reuse of the data input or output from the object

Front 74

remains or partial remains of data (even after overwritting/degaussing)

Back 74

data remanence

Front 75

what is the name of the space within a cluster that is not occupied by the file

Back 75

slack space

Front 76

overwritting data several times ensures what?

Back 76

1) enough randomization to avoid statistical analysis
2) each write works to furhter mask the remnants of any exctromagnetic representaiton of the original info

Front 77

practice of coercion and misdirection to obtain information

Back 77

Social Engineering

Front 78

assertion of a unique user identity

Back 78

identification

Front 79

verifying the identity of athe user

Back 79

authentication

Front 80

3 user identification guidelines

Back 80

Uniqueness,
Nondescriptive,
issuance

Front 81

issuance of identities must be ___ and ____

Back 81

secure and documented

Front 82

different bet password and passphrase

Back 82

passphrases are longer to enter and harder to attack

Front 83

two basic two-factor methods

Back 83

1) asynchronous
2) Synchronus

Front 84

which method is:
auth server provies challenge to remote entity, to which entity calculates response using token and replies

Back 84

Asynchronous

Front 85

paypal football/RSA securID example of which method (time-based, event, location)

Back 85

synchronous

Front 86

swipe card/ATM cards with PINs are examples of

Back 86

memory card

Front 87

data stored on a memory card is

Back 87

unprotected (unencrypted) * unlike smart cards

Front 88

security controls and logic are embedded in the integration circuit

Back 88

Smart Card (can hold more than magnetic stripe)

Front 89

Information on samart card can be divided into what section

Back 89

1) read only
2) added only
3) updated only
4) no access available

Front 90

Types of memory on an ICC (IC card)

Back 90

ROM, PROM (*reqs high voltages), EPROM (erasable programmable read-only memory, operating in one-time programmable mode, req's UV light)
EEPROM (electrically erasable PROM, IC of choise 8-256KB)
RAM

Front 91

most smart card offer between __ and ___ r/w cycles

Back 91

250,000 and 500,000

Front 92

average life of smartcards

Back 92

7-10yrs

Front 93

two types of smart cards

Back 93

contact & contactless (proximity)

Front 94

what provides all the power and signalling control for communications with the Proximity Integrated Circuit Card (PICC)

Back 94

Proximity Coupling Device (PCD)

Front 95

two types of modulation that a PCD uses

Back 95

A, B

Front 96

for smart cards, log-on process is done at?

Back 96

Reader

Front 97

what are the capabilities of smart cards?

Back 97

-Store personal info
-high degree of security(2factor) and portability
-have tamper -resistant storage
-can isolate secuiryt-critical computations within
-officers secure enterprisewide authentication
-used in encryption sytems to store keys
-offers capability to perform encryption algorithms on the card

Front 98

Two types of biometics

Back 98

physiological
behavioral

Front 99

representative of acquiring info about unique , physical attributes, (fingerprint, etc)

Back 99

Physiological

Front 100

what does hand geometry measure?

Back 100

tension in the tendons, temperature, finger and bone length, and hand width

Front 101

located at the back of eye

Back 101

Retina

Front 102

colored material surrounding the pupil that governs the amount of light permitted to enter the eye

Back 102

Iris

Front 103

keystroke pattern analysis and handwritting dynamics are examples of

Back 103

behavioral

Front 104

biometrics are prone to

Back 104

errors, environmental variables

Front 105

three categories of biometic accuracy (all percentages)

Back 105

1) False reject rate (type I error)
2) False accept rate (type II error)
3) Corssover error rate (CER): The point at which the false rejection rates and the false acceptance rates are equal. The smaller the CER, the more accurate the system

Front 106

Biometric consideration

Back 106

resistance to counterfeiting
data storage requirments
user acceptance
reliability and accuracy

Front 107

standard enrollment for authentication should take how long

Back 107

2min

Front 108

most significant disadvantage of biometics

Back 108

inability to revoke the physical attribute of the credential (unlike a token, fob or smartcard)

Front 109

Access control services provide...

Back 109

identification,authentication,authorization,accountability

Front 110

control architecture

Back 110

Host, Requester, Authenticator

Front 111

the requester is also referred to as the what? (provides challenge to the host for authentication)

Back 111

Network Access Server

Front 112

set of technologies intended to offer greater efficiency in the mgmt of diverse user and technical environment

Back 112

Identity mgmt

Front 113

Key mgmt challenges of identity mgt solution

Back 113

consistency, efficient, usability, reliability, scalability

Front 114

Identity mgt solutions should include what:

Back 114

Directories (LDAP), web access mgt, password mgt, legacy SSO, account mgmt, profile update

Front 115

limitation of directories (Critical Path, IBM/Tivoli,Msft,Novell,Oracle, Siemens, Sun/iPlanet)?

Back 115

integration w/ legacy systems

Front 116

Disadvantage of SSO?

Back 116

single point of compromise

Front 117

major drawback of access manamgent systems is?

Back 117

deployment time and cost

Front 118

Access Control Technolgoies

Back 118

SSO, Kerberos, Secure European System for Applications in a Multi-Ventor Environment (SESAME), Security Domains

Front 119

Advantages of SSO

Back 119

-efficient log-on
-users may create stronger pwds
-Time=out and attempt threshold enforced platform-wide
-Centralized admin

Front 120

Disadvantages of SSO:

Back 120

-single point of compromise
-legacy/unique platforms

Front 121

what 4 basic reqts for access control does Kerberos meet?

Back 121

1) Security
2) Reliability
3) Transparance
4) Scalability

Front 122

Three components of Kerberso

Back 122

1) Requesting system (Principle)
2) endpoint dest server
3) kerberos server(KDC)

Front 123

the Keberos distribution ctr is comprised of

Back 123

Auth Svr and TicketGranting Server AS,TGS

Front 124

area based on trues between resources or services sharing a single security policy

Back 124

Security Domain

Front 125

controls placed on data by the owner of the data

Back 125

Discretionary Access Controls (DAC)

Front 126

controls determined by the owner of the system

Back 126

Mandatory access controls (MACs)

Front 127

ACcess control matrix

Back 127

table structure of ACL

Front 128

access in based on a list of rules that dettermined what accesses should be granted

Back 128

rule-based access control

Front 129

access policy based on the function that user is allowed to perform w/in an org

Back 129

role-based access control (RBAC)

Front 130

access based on content of data

Back 130

Content-dependent access control

Front 131

access controls are those employed at a given time for e predetermined duration

Back 131

Temporal (time-based) Isolation

Front 132

RADIUS, TACACS+, and DIAMETER are examples of

Back 132

Centralized Access Control

Front 133

control is given to ppl closer to the resource, (e.g. dept mangers and sometimes users)

Back 133

Decentralized access control

Front 134

two basic analysis methods for IDS

Back 134

pattern matching & anomaly

Front 135

attributes of anomaly-based IDS:

Back 135

-develops baseline of normal traffic activity
-Can id unknown attacks and DoS
-Can be difficult to tune properly
-must have a clear undersatnding of normal traffice enviorment

Front 136

id's any unacceptable deviation from expected behavior based on known protocols and signal an alers

Back 136

protocol anomaly-based intrustion detection

Front 137

Attributes of protocol-anomaly IDS

Back 137

-looks for deviations from stnds (RFCs)
-not signature dep'dnt
-reduces false positives
-may lead to false-positives and fealse-negatives w/ poorly understood protocols
-protocol analysis modules take longer to delploy to customers than signatures

Front 138

attributes of traffic anomaly-based IDS

Back 138

-looks for unusal taffice
-can id unknown attacks/DoS
-can be difficult to tune
-must have clear unstnd of normal traffic enviorment

Front 139

core capability of IDS to to

Back 139

produce alarms

Front 140

3 fundamental components of alarms

Back 140

1) Sensor
2) Control/communication
3) Alert/enunciator/actuator

Front 141

data collected from various systems logging activity

Back 141

audit trail

Front 142

5 key types of audit events

Back 142

1) Network
2) System
3) Application
4) User
5) keystroke

Front 143

logs of file creation/mod/deletions are examples of what type of audit events

Back 143

system

Front 144

logs of URLs request are of what type of audit events?

Back 144

application

Front 145

log-on/off, privilege use, and data access are examples of what kind of audit events

Back 145

User

Front 146

employment of exploittive techniques to dtermin the level or risk associated with an vulnerability/ies

Back 146

Penetration testing

Front 147

primary goal of pen testing

Back 147

simulate an attack

Front 148

key to successful and valuable pentesting:

Back 148

clearly defined objectives, scope, stated goals, agreed upon limitation and acceptable activities.

Front 149

Types of pentest

Back 149

Zero knowledge,
partial knowledge,
Full knowledge

Front 150

Basic methodology of pentesting:

Back 150

1) reconnaissance/discovery
2) Enumeration
3) Vulnerability analysis
4) Exploitation

Front 151

port scanning is part of which phase of pentesting methodology

Back 151

Enumeration

Front 152

process of comparing the information collected with known vulnerabilities

Back 152

Vulnerability analysis

Front 153

The attack process is broken up into

Back 153

threads and groups

Front 154

a collection of tasks that must be performed in a specifi order to acheive a goal

Back 154

thread

Front 155

attack process groups

Back 155

collections of threads

Front 156

divergences from attack plan must be determined in what two ways

Back 156

Expectations (scope, goals, unexpected results)
Technical (system reacting diff than expected)

Front 157

Goals of penetration testing

Back 157

gain awareness and detailed understanding of the state of the security environment

Front 158

Pentest findings document should include

Back 158

findings, tactics used, tools employed, info collected, recommendations

Front 159

Pen test results can help w/ id'ing

Back 159

vulnerabilities, gap in security measures, IDS and intrustion response capability, whether anyone is monitoring audit logs, how suspicious activity is reported, suggessted counter measures

Front 160

blind/double-blind/targeted testing

Back 160

tt giving min/IT staff don't know/both IT and TT know&provided info

Front 161

Types of testing a PentTest team may carry out

Back 161

Application,DoS,War dialing, wireless network, social eng, PBX

Front 162

1. A preliminary step in managing resources is:

Back 162

b. Defining who can access a given system or information

Front 163

2. Which best describes access controls?

Back 163

Access controls help protect against threats and vulnerabilities by reducing exposure to unauthorized activities and providing access to information and systems to only those who
have been approved.

Front 164

3. _______ requires that a user or process be granted access to only those resources necessary
to perform assigned functions.

Back 164

c. Least privilege

Front 165

4. What are the six main categories of access control?

Back 165

b. Deterrent, preventative, detective, corrective, compensating, and recovery

Front 166

5. What are the three types of access control?

Back 166

a. Administrative, physical, and technical

Front 167

6. Which approach revolutionized the process of cracking passwords?

Back 167

b. Rainbow table attack

Front 168

7. What best describes two-factor authentication?
a. Something you know
b. Something you have
c. Something you are
d. A combination of two listed above

Back 168

d. A combination of two listed above

Front 169

8. A potential vulnerability of the Kerberos authentication server is:

Back 169

a. Single point of failure

Front 170

9. In mandatory access control, the system controls access and the owner determines:

Back 170

b. Need to know

Front 171

10. Which is the least significant issue when considering biometrics?
a. Resistance to counterfeiting
b. Technology type
c. User acceptance
d. Reliability and accuracy

Back 171

b. Technology type

Front 172

11. Which is a fundamental disadvantage of biometrics?

Back 172

a. Revoking credentials

Front 173

12. Role-based access control _______:

Back 173

c. Is based on user job functions

Front 174

13. Identity management is:

Back 174

A set of technologies and processes intended to offer greater efficiency in the management of a diverse user and technical environment

Front 175

14. A disadvantage of single sign-on is:

Back 175

b. A compromised password exposes all authorized resources

Front 176

15. Which of the following is incorrect when considering privilege management?

Privileges associated with each system, service, or application, and the defined roles
within the organization to which they are needed, should be identified and clearly
documented.
a.
Privileges should be managed based on least privilege. Only rights required to perform a
job should be provided to a user, group, or role.
b.
An authorization process and a record of all privileges allocated should be maintained.
Privileges should not be granted until the authorization process is complete and validated.
c.
Any privileges that are needed for intermittent job functions should be assigned to multiple
user accounts, as opposed to those for normal system activity related to the job function.

Back 176

Any privileges that are needed for intermittent job functions should be assigned to multiple user accounts, as opposed to those for normal system activity related to the job function.

Front 177

16. Capability lists are related to the subject, whereas access control lists (ACLs) are related to the
object, and therefore:

Back 177

Under access control lists, a user can invoke a program to access objects normally restricted.

Front 178

Special priviliges should be assigned to normal accts (TF)

Back 178

false

Front 179

what provides access control assurance

Back 179

due diligence

Front 180

what are 3 basic reqts of access control

Back 180

1) Scalability
2) Security
3) Transparency

Front 181

An operattional report is:
a) detective
b) corrective
c) preventative
d) directive

Back 181

detective

Front 182

In MAC, the need-to-know element is provided by:

Back 182

Information owner

Front 183

In Content dependent access control the key element that determines access authorization is provided by the

Back 183

arbiter program

Front 184

in non-discretionary access control, the defintion of access rules are closely managed by the

Back 184

Security admin

Front 185

An audit trail should include data about:system-level, app level and user level events and`

Back 185

network connections

Front 186

who is the ultimate data owner

Back 186

CIO

Front 187

why are biometric devices more accurate than other types of auth technologies

Back 187

they're harder to circumvent

Front 188

Type II error:

Back 188

False accept

Front 189

Type I error

Back 189

false reject

Front 190

what type of control is auditing

Back 190

technical

Front 191

password advisor doesa

Back 191

instructs user on pwd that are easy to rmember and difficult to crack

Front 192

syskey

Back 192

ms's pwd db

Front 193

how is Kerberos SSO

Back 193

TGT

Front 194

Capbility tables are bound to

Back 194

subjects

Front 195

Whta is a Kerberos authenticator and what is its purpose

Back 195

Principal identifaction and timestampe encrypted with a shared session key. It is used to authenticate the the requesting principal and is a countermeasure against replay attacks

Front 196

The TGT is generate to allow aprincipal to be able to

Back 196

communicate with the TGS