Karteikarten
Chapter 1: Mastering Security Basics
Karten in diesem Stapel (102)
- 1Security Triad: What are the 4 security goals?1) Confidentiality
2) Integrity
3) Availability
4) Safety - 2prevents the unauthorized disclosure of data (prevents authorized personnel from accessing the data)confidentiality
- 3what are the three ways to ensure confidentiality?1) encryption
2) access controls
3) steganography - 4scrambles data to make it unreadable to unauthorized personnelencryption
- 5What is a good way to ensure confidentiality when using PII, data in databases, and data on mobile devicesencryption
- 6identification, authentication and authorization combined provide access and help ensure that only authorized personnel can access dataaccess controls
- 7what are the three key elements of access controls?1) identification
2) authentication
3) authorization - 8users claim this with a unique user nameidentification
- 9users provide identity with this (password)authentication
- 10granting or restricting access to resources using this method, such as permissionsauthorization
- 11hiding data within data (ex: hiding txt files in an image)steganography
- 12provides assurance that data has not changed (ex: no one has modified, tampered with, or corrupted the data)integrity
- 13what are the three ways to ensure integrity?1) hashing
2) digital signatures, certificates
3) non-repudiation - 14number created by executing an algorithm against data such as a file or message (can be created at source and destination or at two different times)hashing
- 15if hashes are the same then, if hashes are different then,integrity is maintained,
integrity has been lost - 16used for emails to distinguish user from attackerdigital signatures
- 17provided through digital signatures where someone cannot later deny sending an email because the signature proves they didnon-repudiation
- 18signatures require the use of what two things?1) certificates
2) Public Key Infrastructure (PKI) - 19data and services are available when needed (systems are up to date and operation to ensure bugs dont affect this)availability
- 20what are the two ways to ensure availability?1) redundancy and fault tolerance
2) patching - 21adds duplication to critical systems and provides fault toleranceredundancy
- 22a system with _______ ________ can suffer a fault thanks to duplicate redundancies, but tolerate it and continue to operationfault tolerance
- 236 examples of fault tolerance1) disk redundancies (RAID)
2) server redundancies (failover cluster)
3) load balancing
4) backups
5) alt power
6) cooling system - 24software vendors that fix bugs and release code that fixes these problemspatching
- 25individuals and an orgs assetssafety
- 26security practice of implementing several layers of protection (if one fails, you have several layers to protect you)layered security
- 27three examples of layered security1) firewalls
2) intrusion detection system (IDS)
3) proxy servers (for content filtering) - 28any circumstance or event that has the potential to compromise confidentiality, integrity, or availabilitythreat
- 29a weakness (in HW, SW, the configuration, or even the users OS)vulnerability
- 30three examples of threats1) outside threats
2) inside threats
3) natural threats - 31three examples of what threats can beman-made threats (malware)
intentional threats (attackers)
accidental threats (employee mistakes) - 32reduces the chances that a threat will exploit a vulnerabilityrisk mitigation
- 33reduce risks by implementing?controls (countermeasures and safeguards)
- 34what are the two entities of user credentials for authentication?1) claimed identity (user presents credentials)
2) authentication mechanism (authenticator verifies credentials) - 35process of verifying that people are who they claim to be prior to issuing them credentialsidentity proofing
- 362nd form of identity proofing, where something such as a bank re verifies identity when a user transfers money across accts (ex: security questions)issuing credentials
- 37self service system that uses identity proofing to automate the process ex: forgot passwork links, phone based password resetspassword reset/password recovery system
- 38when admins can combine two factors of authenticationdual authentication
- 39when admins can combine multiple factors of authenticationmultifactor authentication
- 405 factors of authentication are1) something you know
2) something you have
3) something you are
4) somewhere you are
5) something you do - 41example of something you knowpassword or PIN
- 42example of something you havesmart card or USB token
- 43example of something you arefingerprint, biometric identity
- 44example of somewhere you arelocation
- 45example of something you dogestures on a touch screen
- 46how can you create strong passwords?uppercase, lowercase, numbers, and special characters
- 47how often should you change passwords?regularly (65 to 90 days)
- 48what should you do before resetting a password?verify users identity
- 495 rules to keep passwords safe1) dont reuse same password
2) implement acct lock out policies
3) change default passwords
4) dont write down
5) dont share passwords - 50keyspace formulaC^N (C to the Nth power)
C: # of possible character uses
N: length of password - 51string of characters that has meaning to the userpassphrase
- 52max # of times user can enter passwordacct lockout threshold
- 53how long an acct remains lockedacct lockout duration
- 54credit-card sized cards that have embedded microchip and a certificate **provides confidentiality, integrity, authentication, and non-repudiationsmart cards
- 55requirements for a smart card are:1) embedded certificate (private and public key)
2) public key infrastructure (PKI) (supports issuing and managing certificates) - 56smart card key in an embedded certificate that is only accessed by userprivate key
- 57smart card key in an embedded certificate that is publicly available to otherspublic key
- 586 examples of something you have1) smart cards
2) CAC
3) PIV
4) token or key fob
5) HOTP
6) TOTP - 59what two exmaples in something you have provide dual factor authentication?CACs and PIV
- 60electronic device that contains a LCD that displays a number periodically ex: RSA IDstoken or key fob
- 61password that are valid for an unknown amount of timeHOTP (HMAC One time Password)
- 62password that keeps changing and are only valid for a short period of timeTOTP
- 63Something You Are: 5 Biometric Methods include:1) fingerprint and thumbprint
2) handprint
3) palm
4) retina
5) iris - 64Biometric errors: 1) system identifies unauthorized user as an authorized user 2) system incorrectly rejects authorized user1) false acceptance
2) false rejection - 65group of technologies used to identify a users location; what can you use for this?geolocation
a computer name or MAC address - 66authentication system uses what for geolocationinternet proocol
- 67time a key is presseddwell time
- 682 examples of something you do1) dwell time
2) flight time - 69time between releasing one key and pressing the nextflight time
- 703 examples of dual factor authentication1) smart card and PIN
2) USB token and PIN
3) smart card and password - 713 examples of Authentication Services1) Kerberos
2) LDAP and Secure LDAP
3) Single Sign-On - 72provides mutual authentication that can help prevent the man-in-the-middle attacks and uses tickets to help prevent replay attacksKerberos
- 733 requirements for Kerberos1) method of issuing tickets used for authentication
2) time sychronization
3) db of subjects of users - 74single key for encryption and decryption of datasymmetric encryption
- 75uses two keys, one to encrypt one to decrypt (PKI public and private key)asymmetric encryption
- 76accesses directory services that contains objects related to users, groups, computers, printers, specifically X.500-based directory servicesLightweight Directory Access Protocol (LDAP)
- 77db of objects that provides a central access point to manage users, computers, and other objects (LDAP gives you query methods to add, update, remove objects within this)directory
- 78directory of objects (computers, users) that provides a single location for object managementActive Directory
- 79Example of an LDAP string: a user named Homer in the users container within the GetCertifiedAhead.com is identified with this string: identify the acronyms LDAP://CN=Homer, CN = Users, DC=GetCertifiedAhead.com,DC=comCN=Homer: common name
CN=Users: container
DC=GetCertifiedAhead.com:domain component
DC=com: 2nd domain component - 80uses encryption to protect LDAP transmissions --what encrypts this data before transmission?Secure LDAP
Transport Layer Security (TLS) - 81the ability of a user to log on or access multiple servers within a network to perform normal work **user only needs to log on to a network onceSingle Sign-On
- 82creates an indirect trust relationshipSSO & Transitive Trusts
- 83Example of?: Homers user account is the training domain. Within this, it is possible to grant Homer access to the Cosington server in the blog domain with out creating another trust relationship between the 2 childrenLDAP Transitive Trust used for SSO
(parent domain speaks to children, but children only speak to parents and not to each other) - 84system can connect authentication mechanisms from different environments, such as different operating systems and different networksSSO and a Federation
- 85Example Of?: joining a power plant and school system network where the power plant can sign on to the school systems network once to use itSSO and a Federation
- 86an Extensible Markup Language (XML)-based data format used for SSO on web browsersSecurity Assertion Markup Language (SAML)
- 87Example of?: two websites hosted by two different organizations: if orgs trust each other they can use this as a federated identity management systemSSO and SAML
- 88Roles of SAML are: 1) users log on once, sometimes asks for identity 2) creates, maintains, and manages identity information for principals 3) entity that provides services to principals1) principal
2) identity provider
3) service provider - 89provides access to an internal network from an outside sourceRemote Access Server (RAS)
- 90allows a client to access a private network over a public network, such as the InternetVIrtual Private Network (VPN)
- 91Remote Access Authentication Mechanisms are: (8):1) PAP
2) CHAP
3) Microsoft-CHAP
4) MS-CHAP v2
5) RADIUS
6) Diameter
7) XTACACS
8) TACACS+ - 92a more efficient method of connecting to remote servers such as Internet Service Providers (ISP) using Point-to-Point Protocol (PPP)Password Access Protocol (PAP)
significant security risk - 93authenticates remote users and uses PPP, but more secure than PAPChallenge Handshake Authentication Protocol (CHAP)
- 94Example of a remote access authentication mechanism: client can pass credentials over a public network (such as a phone or internet) without allowing attackers to intercept dataChallenge Handshake Authentication Protocol (CHAP)
- 95created by Microsoft, has the ability to perform mutual authentication (assures servers identity before client transmits data)Microsoft-CHAP & Microsoft-CHAP v2
- 96centralized authentication service (instead of each individual needing a separate database to identify who can authenticate, authentication requests are forwarded to a central ______ server)Remote Authentication Dial In User Service (RADIUS)
- 97Example of?: Clients that user AOL servers located in different cities can speak to this one centralized serverRADIUS
- 98upgrade of RADIUS and uses Extensible Authentication Protocol (EAP) which enhances securityDiameter
- 99Cisco alternative to RADIUSTACACS+
- 100What are the two benefits to TACACS+?1) encrypts entire authentication process (RADIUS only encrypts password)
2) uses multiple challenges and responses between client and server (you can authenticate users before they have access to a router or switch) - 101provides authentication, authorization, and accounting (tracks user access with logs)AAA protocols
- 102examples of AAA protocols?RADIUS and TACACS+
Informationen
- Beschreibung
- Karteikarten am Chapter 1: Mastering Security Basics, erstellt von Callie Smith am 31/03/2017.
- Erstellt von
- Callie Smith
- Aufrufe
- 0
- Bewertung