Question 1

What category is involved with access control layers?

Accepted Answer

Access control layers consist of administration controls, physical controls, and technical controls. Administrative controls are directives that will dictate how all the supporting mechanisms will fall into place and include: policy and procedures, personnel controls, supervisory structure, security-awareness training, and testing. Physical controls support and work with administrative and technical controls to supply the right degree of access controls and include: network segregation, perimeter security, computer controls, work area separation, data backups, cabling, and control zones. Technical controls are software tools used to restrict subjects' access to objects and include: system access, network architecture network access, encryption and protocols, and auditing.

Question 2

Access control layers consist of administrative controls, physical controls, and technical controls that work at different levels of what?

Accepted Answer

Access control layers consist of administrative controls, physical controls, and technical controls that work at different levels within their own categories. Each control works at a different level of granularity, but it can also perform different functionalities. The different functionalities of access control are preventive, detective, corrective, deterrent, recovery, compensating, and directive.

Question 3

What is based on the sensitivity of data and knows what actions should be allowed?

Accepted Answer

Content-dependent access control is based on the sensitivity of data and knows what actions should be allowed. The software must keep track of previous access attempts by the user and understand what sequences of access steps are allowed. Content-dependent access control is not as complex as context-dependent control because of the amount of items that needs to be processed by the system.

Question 4

What could a company do to prevent an employee from accessing a higher level of access by preventing them from even knowing it exists?

Accepted Answer

Polyinstantiation prevents an employee from accessing a higher-level of access by preventing them from even knowing it exists. Polyinstantiation enables a table that contains multiple tuples with the same primary keys, with each instance distinguished by a security level. When this information is inserted into a database, lower-level subjects must be restricted from it.

Question 5

What is defined as a set of objects that a subject is able to access?

Accepted Answer

Domain is defined as a set of objects that a subject is able to access. This domain can be all the resources a user can access, all the files available to a program, the memory segments available to a process, or the services and processes available to an application. A subject needs to be able to access and use objects to perform tasks and the domain defines which objects are available to the subject and which objects are untouchable and therefore unusable by the subject.

Question 6

Jeffery is signing in to his network station and is being challenged by a random value called a nonce. Why type of device is this?

Accepted Answer

A device that challenges at a random value called a nonce is an asynchronous token. The device generates a method to employ a challenge/response scheme to authenticate the user. The user enters this random value to the toke device, which encrypts it and returns a value the user uses as an on-time password. The user sends this value, along with a username, to the authentication server. If the authentication server can decrypt the value and it is the same challenge value sent earlier, the user is authenticated.

Question 7

What type of access control synchronizes with the authentication service by using time or a count as the core piece of the authentication process?

Accepted Answer

A synchronous token device synchronizes with the authentication service by using time or a count as the core piece of the authentication process. If the synchronization is time-based, the token device and the authentication service must hold the same time within their internal clocks. The time value on the token device and a secret key are used to create the one-time password, which is displayed to the user.

Question 8

What broad term encompasses the use of different products to identify, authenticate, and authorize users through automated means?

Accepted Answer

Identity management is a broad term that encompasses the use of different products to identify, authenticate, and authorize users through automated means. The term also includes user account management, access control, password management, single sign-on functionality, managing rights and permissions for user accounts, and auditing and monitoring of all of these items.

Question 9

What security measure analysis is a unique personal attribute or behavior?

Accepted Answer

Biometrics is a security measure that analyses a unique personal attribute or behavior. This is one of the most effective and accurate method of verifying identification. Biometrics is a very sophisticated technology; thus, it is much more expensive and complex than the other types of identity verification processes. A biometric system can make authentication decisions based on an individual's behavior, such as signature dynamics, but these can change over time and possibly be forged.

Question 10

Biometrics measures unique personal attributes or behaviors. What type of biometric analysis is the most accurate?

Accepted Answer

The iris scan is the most accurate biometric analysis. The iris is the colored portion of the eye that surrounds the pupil. The iris has unique patterns, rifts, colors, rings, coronas, and furrows. The uniqueness of each of the characteristics within the iris is captured by a camera and compared with the information gathered during the enrollment phase. The iris remains constant through adulthood, which reduces the type of errors that can happen during the authentication process.

Question 11

Biometrics measures unique personal attributes or behaviors. What type of biometric analysis looks at different peaks and valleys of the hand?

Accepted Answer

Hand Topography is a biometric measure that looks at different peaks and valleys of the hand. Hand topology looks at the different peaks and valleys of the hand, along with this overall shape and curvature. When an individual wants to be authenticated, she places her hand on the system. Off to one side of the systems, a camera snaps side-view pictures of the hand from a different view and angle than that of systems target hand geometry, and thus captures different data. This attribute is not unique enough to authenticate individuals by itself and is commonly used in conjunction with hand geometry.

Question 12

Olivia provided security features that control how users and systems communicate and interact with other systems and resources. What did Olivia create?

Accepted Answer

Access controls provide security features that control how users and systems communicate and interact with other systems and resources. They protect the systems and resources from unauthorized access and can be components that participate in determining the level of authorization after an authentication procedure has successfully completed. Note that access control is a broad term that covers several different types of mechanisms that enforce access control features on a computer systems, networks, and information.

Question 13

Once an organization determines it needs to have access control techniques and technologies in place, it must choose which kind. What kind uses specific rules that indicative what can and cannot happen between a subject and an object?

Accepted Answer

Rule-based access uses specific rules that indicative what can and cannot happen between a subject and an object. It is based on the concept of "if X then Y" programming rules, which can be used to provide finer-grained access control to resources. Before a subject can access an object in a certain circumstance, it must meet a set of predefined rules. There are three different access control models. DAC: Data owners decide who has access to resources, and ACLs are used to enforce the security policy. MAC: Operating systems enforce the system's security policy through the use of security labels. RBAC: Access decisions are based on each subject's role and/or functional position.

Question 14

What protocol combines the authentication and authorization functionality?

Accepted Answer

The RADIUS protocol combines the authentication and authorization functionality. It stands for Remote Authentication Dial-In User Service. It is a network protocol and provides client/server authentication and authorization and audits remote users. The access server requests the remote user's logon credentials and passes them back to a RADIUS server, which houses the user-names and password values. The remote user is a client to the access server and the access server is a client to the RADIUS server.

Question 15

What method gives control of access to the people that are closer to the resources that may better understand who should and should not have access to certain files, data, and resources?

Accepted Answer

The decentralized access control administration method gives control of access to the people that are closer to the resources that may better understand who should and should not have access to certain files, data, and resources. In this approach, it is often the functional manager who assigns access control rights to employees. An organization may choose to use a decentralized model if its managers have better judgment regarding which users should be able to access different resources and there is no business requirement that dictates strict control, through a centralized body is necessary.

Question 16

What is made up of hardware, software, and firmware components that fall within the TCB and enforces the reference monitor concept?

Accepted Answer

A security kernel is made up of hardware, software, and firmware components that fall within the TCB and implements and enforces the reference monitor concept. The security kernel mediates all access and functions between subjects and objects. The security kernel is the core of the TCB and is the most commonly used approach to building trusted computing systems. The security kernel has three main requirements: 1) it must provide isolation for the processes carrying out the reference monitor concept and the processes must be tamperproof. 2) It must be invoked for every access attempt and must be impossible to circumvent. Thus, the security kernel must be implemented in a complete and foolproof way. 3) It must be small enough to be tested and verified in a complete and comprehensive manner.

Question 17

There are two processes taking place at the same time, as in data within a variable, through a shared resource, in an incorrect order. What term is being applied?

Accepted Answer

A race condition is when two processes take place at the same time, as in data within a variable, through a shared resource, in an incorrect order. It is important that the processes carry out their functionality in the correct sequence. If process 2 carried out its task on the data before process 1, the result will be much different than if process 1 carried out its tasks on the data before process 2. In software, when the authentication and authorizations steps are split into two functions, there is a possibility an attacker could use a race condition to force the authorization step to be completed before the authentication step.

Quiz 5: ID and Access