Podcast
Questions and Answers
Which type of authentication involves something you know?
Which type of authentication involves something you know?
- Type 2 Authentication
- Type 3 Authentication
- Multi-factor Authentication
- Type 1 Authentication (correct)
Passwords are considered the strongest form of authentication.
Passwords are considered the strongest form of authentication.
False (B)
What is an example of Type 3 Authentication?
What is an example of Type 3 Authentication?
Biometrics (e.g., fingerprint, iris scan)
Secret questions as knowledge factors are often _____ examples because they can be easily researched.
Secret questions as knowledge factors are often _____ examples because they can be easily researched.
Match the following types of authentication with their definitions:
Match the following types of authentication with their definitions:
What is a common characteristic of weak passwords?
What is a common characteristic of weak passwords?
Key stretching adds time to password verification to prevent brute-force attacks.
Key stretching adds time to password verification to prevent brute-force attacks.
Name one strategy to enhance password security.
Name one strategy to enhance password security.
What is a key limitation of brute force attacks when it comes to one-time pads?
What is a key limitation of brute force attacks when it comes to one-time pads?
Clipping levels are used to prevent users from guessing passwords by restricting logins.
Clipping levels are used to prevent users from guessing passwords by restricting logins.
What is the minimum password length recommended by the U.S. Department of Defense?
What is the minimum password length recommended by the U.S. Department of Defense?
A single-use password is also known as a _____ in online banking.
A single-use password is also known as a _____ in online banking.
Match the following password management terms with their definitions:
Match the following password management terms with their definitions:
Which of the following is NOT a possession factor in Type 2 authentication?
Which of the following is NOT a possession factor in Type 2 authentication?
Single-use passwords are considered very convenient by most users.
Single-use passwords are considered very convenient by most users.
How long is an account typically locked after too many failed login attempts?
How long is an account typically locked after too many failed login attempts?
Which of the following is NOT a method of biometric authentication?
Which of the following is NOT a method of biometric authentication?
Behavioral characteristics used in biometrics are permanent and never change.
Behavioral characteristics used in biometrics are permanent and never change.
Name one potential health issue that can be revealed through biometric authentication.
Name one potential health issue that can be revealed through biometric authentication.
Biometric data collection can be more invasive, particularly when it involves __________.
Biometric data collection can be more invasive, particularly when it involves __________.
Which of the following is a characteristic of contactless cards?
Which of the following is a characteristic of contactless cards?
Match the following biometric methods with their characteristics:
Match the following biometric methods with their characteristics:
What is a major issue with biometric authentication?
What is a major issue with biometric authentication?
HOTP stands for HMAC-based One-Time Password.
HOTP stands for HMAC-based One-Time Password.
What does FRR stand for in biometric authentication?
What does FRR stand for in biometric authentication?
The U.S. Office of Personnel Management suffered a data breach involving biometric data.
The U.S. Office of Personnel Management suffered a data breach involving biometric data.
Biometric identifiers are categorized as physiological and __________ characteristics.
Biometric identifiers are categorized as physiological and __________ characteristics.
Biometric authentication can be compromised by __________ of the individual's features.
Biometric authentication can be compromised by __________ of the individual's features.
Match the following types of cards with their characteristics:
Match the following types of cards with their characteristics:
The Crossover Error Rate (CER) represents which of the following?
The Crossover Error Rate (CER) represents which of the following?
Contact cards can only be credit cards.
Contact cards can only be credit cards.
What are examples of something you are in authentication methods?
What are examples of something you are in authentication methods?
What is the main principle of the Least Privilege access control concept?
What is the main principle of the Least Privilege access control concept?
Mandatory Access Control (MAC) assigns access based on user identity alone.
Mandatory Access Control (MAC) assigns access based on user identity alone.
What does RBAC stand for in access control?
What does RBAC stand for in access control?
Access control that uses labels to assign permissions based on clearance is known as _____ .
Access control that uses labels to assign permissions based on clearance is known as _____ .
Which method of access control is often used when confidentiality is most important?
Which method of access control is often used when confidentiality is most important?
Define the term 'Need to Know' in access control.
Define the term 'Need to Know' in access control.
Match the access control method with its primary focus:
Match the access control method with its primary focus:
Attribute-Based Access Control (ABAC) is a policy-neutral access control mechanism.
Attribute-Based Access Control (ABAC) is a policy-neutral access control mechanism.
Flashcards are hidden until you start studying
Study Notes
Identification and Authentication
- Identification establishes the user’s identity through factors like name, username, or ID number.
- Authentication confirms identity with multi-factor methods for better security.
Authentication Types
-
Type 1 (Knowledge Factors): Use something known (e.g., passwords, PINs).
- Most common form; weakest due to vulnerability to compromise.
- Ensure passwords are complex (14+ characters, include numbers and symbols).
- Password policies include expiration dates and limits on reuse to enhance security.
- Secret questions are often poorly chosen and can be easily researched.
-
Type 2 (Possession Factors): Use something possessed (e.g., ID cards, tokens).
- Forms of possession include credit cards and smart cards.
- Single-use passwords enhance security but may be inconvenient for users.
- Magnetic stripe cards are easy to duplicate; smart cards use integrated circuits.
- Tokens can be hardware or software-based, with HOTP and TOTP protocols.
-
Type 3 (Biometric Factors): Use unique biological traits (e.g., fingerprints, facial recognition).
- More secure but can have false acceptance/rejection issues.
- Biometric systems must balance false rejection rate (FRR) and false acceptance rate (FAR) to achieve a crossover error rate (CER).
- Physiological characteristics are stable, while behavioral characteristics may change.
Issues with Biometric Authentication
- Biometric data can expose sensitive information about health and identity, raising privacy concerns.
- Attacks can involve duplicating biometric traits from images or recordings.
- Lost passwords or ID cards can be replaced; compromised biometrics cannot.
Authorization
- Authorization determines what information users can access.
- Implement access control models based on security goals, including Least Privilege and Need to Know principles.
Access Control Models
-
Discretionary Access Control (DAC):
- Object owners assign permissions at their discretion; common in file systems.
- Utilizes Discretionary ACLs (DACLs) based on user identification.
-
Mandatory Access Control (MAC):
- Access is based on labels and classifications; prioritizes confidentiality.
- Requires user's clearance level to surpass the object's security label.
-
Role-Based Access Control (RBAC):
- Access is based on user roles, simplifying management of permissions within large organizations.
- Enforces separation of duties to prevent privilege creep.
-
Attribute-Based Access Control (ABAC):
- Combines user, object, and environmental attributes to determine access.
- Offers flexibility in access management based on dynamic conditions.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
