1
Q
- Authentication method
- Testing the subject with some sort of challenge and response where the subject must respond with a knowledgeable answer
- i.e. password or PIN
A
Type 1 Authentication: Something You Know
2
Q
- Type of Password
- Reusable passwords that may or may not expire
- Typically user-generated
A
Static Passwords
3
Q
- Type of Password
- Long passwords comprised of words in a phrase or sentence
- i.e. “I will pass the CISSP”
A
Passphrases
4
Q
- Type of Password
- Authentication that is only valid for one-time use
A
One-time Passwords
5
Q
- Type of Password
- Authentication that changes at regular intervals
- i.e. RSA security token
A
Dynamic Passwords
6
Q
- The process of trying to predict a password in order to authenticate while online
- Account lockouts is a prevention
A
Password guessing
7
Q
Attacker has gained access to the password hashes or database and compares the output to a desired hash hoping to find a match therefore deriving the original password
A
Password Cracking
8
Q
- Password Attack
- Uses a word list each of which is hashed
- Cracking software matches hash output to the password hash; if a match we‘ve identified the password
A
Dictionary Attack
9
Q
- Password Attack
- Appends, prepends, or changes characters in words from a dictionary before hashing in order to attempt the fastest crack of complex password
A
Hybrid Attack
10
Q
- Password Attack
- Attacker calculates the hash outputs for every possible password.
A
Brute-Force Attacks
11
Q
Database that contains the precomputed hashed output for most of all possible passwords
A
Rainbow table
12
Q
- Random value added to the plaintext password before hashing
- Adds complexity to hashed password stored in database
- Protects against rainbow attacks
A
Salt
13
Q
- Authentication method
- Requires that users possess something
- i.e. token
A
Type 2 Authentication: Something You Have
14
Q
- Time-based and synchronized with an authentication server (AS).
- New password generated periodically (i.e. every 60 secs)
- Does require the token and the server to have accurate time
A
Synchronous Dynamic Passwords
15
Q
- Creates a dynamic one time password that stays the same until used for authentication
- Hardware token generates passwords based on an algorithm and an incrementing counter
- Does not use a clock
A
Asynchronous Dynamic Passwords
16
Q
- Authentication method
- Uses a physical characteristics as a means of identification or authentication
- i.e. facial recognition system or fingerprint
A
Type 3 Authentication: Something You Are
17
Q
The process of registering with the biometric system
A
Biometric Enrollment
18
Q
- The process of authenticating to a biometric system
- Typically 6-10 secs
A
Throughput
19
Q
- Occurs when an authorized subject is rejected by the biometric system as unauthorized
- Type I error
A
False Rejection Rate
20
Q
- Occurs when an unauthorized subject is accepted as valid
- Type II error
A
False Acceptance Rate
21
Q
- The point where False Rejection Rate and False Acceptance Rate are equal
- Describes the overall accuracy of a biometric system
- AKA Equal Error Rate (EER)
A
Crossover Error Rate
22
Q
Most widely used biometric control
A
Fingerprints
23
Q
Includes specific details of fingerprint friction ridges like whorls, ridges and bifurcation
A
Minutiae
24
Q
- Laser scan of capillaries that feed the back of the eye
- This biometric control raises privacy concerns because conditions such as pregnancy and diabetes can be determined
- Rarely used
A
Retina scan
25
- Camera takes a picture of the colored portion of the eye and then compares photos within the authentication database
- Scan even works if person is wearing contact lenses or glasses
- This is unique on every person, including twins
Iris scan
26
- Biometric control
| - Takes measurements from specific points on a subject’s hand
Hand Geometry
27
- Biometric control
| - Refers to how hard a person presses each key and the rhythm in which the keys are pressed.
Keyboard Dynamics
28
- Biometric control
| - Measures the process by which someone signs his/her name
Dynamic Signatures
29
- Biometric control
| - Measures the subject’s tone of voice while stating a specific sentence or phrase
Voiceprint
30
- Biometric control
| - Process of taking a picture of a subjects face and comparing that picture to a list stored in a database
Facial scan
31
- Describes location-based access control using technologies
- i.e. GPS, IP address-based geolocation
Someplace You Are
32
- OASIS standard typically used to define access control policies i.e. attribute-based or role-based
- Most commonly used by software-define-networking systems
Extensible Access Control Markup Language (XACML)
33
- Used for federated identity SSO
| - Based on DSML, which is used to present LDAP info in XML format
Security Provisioning Markup Language (SPML)
34
- Large constant value added to the plaintext password before hashing
- Value is stored somewhere outside the database holding the hashed passwords
Pepper
35
What are some algorithms that add a salt to a password and repeat the hashing function many times?
bcrypt
| Password-Based Key Derivation Function 2 (PBKDF2)
36
- Type 3 authentication factor
| - Behavioral biometrics i.e. signature and keystroke dynamics
Something-you-do
37
- ID or badge that has an integrated circuit chip embedded in it
- Certificate inside microprocessor can be used for authentication, to encrypt data, digitally sign email and etc...
Smartcard
38
Card that holds authentication information for a user
Memory card
39
Authentication method that uses situational info (i.e. identity, geolocation, geofence, time of day, type of device) to determine who can access a network
Context-Aware authentication
40
Virtual perimeter identifying the location of the building and can identify when a user is in the building
Geofence
41
Series of challenge questions about facts or predefined response that only the subject should know
Cognitive Passwords
42
- Worn smartcards by personnel within the US government
| - Users wear them while walking around and insert them into card readers at their computer when logging on
Common Access Cards (CACs)
| Personal Identity Verification (PIV)
43
- Standard to create one time passwords
- Typically creates values of six to 8 numbers
- Values remain valid until used
HMAC-based One-Time Password (HOTP)
44
- Standard to create one time passwords
- Uses a timestamp and remains valid for a certain timeframe (i.e. 30 secs)
- Password expires if user does not use within timeframe
Time-based One-Time Password
45
- Biometric control
| - Use near-infrared light to measure vein patterns in the palm, which are as unique as fingerprints
Palm scanners
46
- Biometric control
| - Ensures that a real person is providing the biometric factor
Heart/Pulse Patterns
47
Database where users biometric data is stored
Reference profile
CISSP
flashcards
Decks in class (30)
# Cards
-
Domain 1: Legal and Regulatory Issues58
-
Domain 1: Risk Analysis34
-
Domain 1: Everything Else45
-
Domain 1: Threat Modeling29
-
Domain 2: Classifying Data39
-
Domain 2: Memory and Remanence27
-
Domain 2: Determining Data Security Controls30
-
Domain 3: Security Models31
-
Domain 3: System Design48
-
Domain 3: System Vulnerabilities40
-
Domain 3: Cryptography31
-
Domain 3: Types of Cryptography38
-
Domain 3: Cryptography Attacks and Implementing34
-
Domain 3: Environmental Controls41
-
Domain 4: Communication and Network Security37
-
Domain 5: Authentication Methods47
-
Domain 5: Access Control Technologies49
-
Domain 6: Security Assessment and Testing26
-
Domain 7: Forensics and Incident Response30
-
Domain 7: Assessment Management31
-
Domain 7: BCP/DRP29
-
Domain 7: BCP/DRP pt 230
-
Domain 7 : Backups20
-
Domain 8: Programming Concepts37
-
Domain 8: Databases25
-
Domain 8: Software Security32
-
Domain 4: Communication and Network Security Pt 230
-
Domain 4: Communication and Network Security Pt 339
-
Domain 8: Database pt 223
-
Domain 6: Security Assessment and Testing pt 226
