CISSP Cheat Sheet Series

Domain 5: Identity & Access Management

Three-factor Authentication (3FA)
Knowledge factor Something that is known by the userOwnership factor

Something that the user possesses, like a key or a token.

Characteristic
factor

A user characteristic, such as biometrics; ﬁngerprints, facescan, signature.

Terminology

Access Control Requirements

AccessAction required to allow information ﬂow between objects.

Control

Security measures taken to restrict or allow access to systems.

Subject

An entity which requires access to an object or objects.

ObjectEntity which consists information.

Identiﬁcation• Registration veriﬁcation of user identity and add anidentiﬁer to system.
• Assign user the proper controls• Commonly use user ID or username.

Access is controlled by information owners, Can be lessconsistent.

Authentication• User veriﬁcation process• Commonly used passwords

Combination of centralized and decentralized.

Authorization• Deﬁning resources for user accessAccountability• Person responsible for the controls, uses logs.

Levels of Access & Control

Knowledge –Type/category 1 – something you know

Only one component can control access. Highly restrictedlevel where control done centrally.

Password authentication, Secret questions such as mother’s maiden name,favorite food, date of birth, key combination / PIN.

Decentralizedadministration

Salted hashRandom data added to a password before hashing andstoring in a database on a server. Used instead ofplaintext storage that can be veriﬁed without revealing
password.

ComplEg.
password

Alphanumeric, more than 10 characters. Includes a
combination of upper and lower case letters, numbers
and symbols.

One-time password(OTP)

Dynamically generated to be used for one session ortransaction.

HybridAccess stances
SingleSign-On(SSO)

allow-by-default or deny-by-default• A.K.A federated ID management• Pros – ComplEg. passwords, easy administration, fasterauthentication.
• Cons – Risk of all systems comprised by unauthorizedaccess of a key or keys.

Authorization
Access control policies: Level of access and controls granted for a user.
Separation ofduties

Assigning different users different levels of access toprotect privacy and security.

Something used to identify a person, i.e. pets name,Cognitive password favorite color, mother’s maiden name etc, place of birthetc.

Dual Controls

Access to perform speciﬁc functions is granted to two ormore users.

Password Hacking

Unauthorized access of a password ﬁleSplit Knowledge

No single user can have full information to perform a task.

Brute force attack

Multiple attempts using all possible password or pin
combinations to guess the password.

Principle of Least
Privilege

User is given minimum access level needed to perform atask.

Dictionary attack

Type of brute force attack that uses all the words fromthe dictionary.

Need-to-Know

Minimum knowledge level to perform a task.

No AccessUser is not assigned any access for any object.

Static password

Password does not change. To be avoided.

Social engineering
attackGain access by impersonating a user by establishinglegitimate user credentials through social manipulation oftrusted parties or authorities.

Rainbow Tables

Precomputed table for reversing cryptographic hashfunctions and cracking passwords.

Directory Service

Synchronous token
Asynchronoustoken
Memory card

Create password at regular time intervals.
Generate a password based on the challenge-responsetechnique.
A swipe card containing user information.

Smart Cards orIntegrated Circuit
Card (ICC)

A card or dongle that includes a chip and memory, likebank cards or credit cards.

Contact Cards

Swiped against a hardware device.

Contactless Cards
or Proximity Cards

Simply need to be within proximity to the reader device.

Hybrid Cards

Allows a card to be used in both contact and contactlesssystems.

USB drive

Centrally managed database for user objects management.
i.e. LDAP

Kerberos

Client /server model authentication protocol.
• Symmetric Key Cryptography• Key Distribution Center (KDC)• Conﬁdentiality and integrity and authentication,
symmetric key cryptography

RealmAuthentication administrative domain. Uses symmetric-keycryptography

KDC (KeyDistributionCenter)

Issues tickets to client for server authentication• Stores secret keys of all clients and servers in the network• AS (Authentication Server)• TGS (Ticket Granting Server)

The Kerberos
logon process• User input username/password in client PC/Device.
• Client system encrypts credentials using AES to submitfor KDC.
• KDC match input credentials against database.
• KDC create a symmetric key and time-stamped TGT to beused by the client and the Kerberos server.
• Key and TGT are encrypted using client password hash.
• Client installs the TGT and decrypts the symmetric key
using a hash.

Ownership –Type/category 2 – Something you have

Bespoke USB with access credentials

Static password
token

Simplest type of security token where the password isstored within the token.

Challenge/response token

A challenge has to be met by the correct user response.

Characteristic –Type/category 3 – Something you do / areBiometric technology allows the user to be authenticated based on
physiological behavior or characteristics.
• Physiological i.e. Iris, retina, and ﬁngerprints.
• Behavioral i.e. Voice pattern

Discretionary Access Control (DAC) • Mandatory Access Control (MAC) •Role-based Access Control (role-BAC) • Rule-based Access Control (Rule-BAC).
Discretionary Access Control(DAC)

Uses access control lists (ACLs Access-control lists).

Mandatory Access Control(MAC)

Subject authorize according to security labels.
Used by owners to grant or deny access toother users. ACL deﬁnes the level of accessgranted or denied to subjects.
Task-based access controls - subjects require
access an object based on its role orassigned tasks.

Role-BAC (RBAC)

Hand Geometry

Scans the thumb or edge of the ﬁnger.
Size, shape, bone length, ﬁnger length, or other layout
attributes of a user’s hand are taken.

Hand Topography

Hand peaks and valleys pattern.

Palm or Hand Scan

Fingerprint and geometry combination of palm.

Facial Scan

Facial features such as bone, eye length, nose, chin shapeetc.

Retina Scan

Retina blood vessel scan.

Retina blood vessel
scan
Vascular Scans
Voice print

Scans the colored part of the eye around the pupil.
Scans the pattern of the veins in the users hand or face.
Verify speech sound patterns.

Scanning Behaviors
Signature Dynamics Pen pressure and acceleration is measured.
Keystroke
Dynamics

Scan the typing pattern.

Voice Pattern /Print

Measures the sound pattern of a user read particularword.

Biometric
Considerations

Does not change throughout human life and unique. Highaccuracy rate.

Enrollment Time

Sample processing for use by the biometric system.

Feature Extraction

The process of obtaining the information from acollected sample.

Accuracy

Scan the most important elements for correctness.

Throughput Rate

The rate which the system can scan and analyze.

False Rejection
Rate (FRR)

The percentage of valid users that will be falsely rejected.
Type 1 error.

False Acceptance
Rate (FAR)

The percentage invalid users that will be falsely accepted.
Type 2 error.

Crossover Error
Rate (CER)

The point at which FRR equals FAR. This is expressed asa percentage - lower CER is better.

Biometric scans

Order of effectiveness and accuracy: Iris Scan • Retina
Scan • Fingerprint • Hand Geometry • Voice Pattern •Keystroke Pattern • Signature Dynamics.

Uses a set of rules or ﬁlters to deﬁne what
can or cannot be done on a system.

Rule-BAC
Hybrid RBAC

Limited RBAC

Lattice based / LabelNon-discretionary access /Mandatory-Access control

SESAME (Secure European System for Applications ina Multi-vendor Environment)
Public Key cryptology only authenticates initial segment withoutauthenticating full message. Two separate tickets are in use one forauthentication and other one deﬁnes the access privileges for user. Bothsymmetric and asymmetric encryptions are used.
Exchange authentication and authorization information
between security domains and systems.
• Components: Principal User • Identity provider • Serviceprovider.
• Use in directory federation SSO.

SAML (SOAP/XML)

Authorization Concepts
Security
domainSet of resources having the same security policies.

Federated
Identity

Organization having a common set of policies and standards
within the federation.

Federation Models
Every organization is certiﬁed and trusted by the other
Cross-Certiﬁcation
organizations within the standards deﬁned internally byModelsaid organizations.
TrustedThird-Party /Bridge ModelEvery organization adheres to the standards set by a thirdparty.

IDaaS (Identity asa Service)

Identity and access management is provided by a thirdparty organization.

SSO (Singlesign-on)

Access management for multiple similar, yet independantsystems. Primarily used for the cloud and SaaS based
system access.

Cloud Identity

User account management (Oﬃce 365)

Directory
Synchronization

On-premises identity provider (Microsoft Active directory)

Federated Identity

On-premises identity provider for managing login request.
(MS AD)

Access Control Models
Implicit Deny

By default access to an object is denied unless explicitlygranted.

Access Control
Matrix

Table which included subjects, objects, and access
controls / privileges.

Capability Tables

List access controls and privileges assigned to a subject.
• ACLs focus on objects whereas capability lists focus onsubjects.

Permissions
RightsPrivileges

Authorization Methods

Physiological Characteristics
Fingerprint

Identity Management
IAAA – Identiﬁcation - Authentication - Authorization - Accountability.

Centralizedadministration

Terminology and concepts

CIA Triad: Conﬁdentiality - Integrity - Availability (See Domain 1 cheatsheet!!!!!)

Ability/access to perform an action on an object.
Combination of rights and permissions.

Access Control Categories
Category

Scope / Purpose

ExampleCompensative

Risk mitigation action.

Two keys or key andcombination to open a safety
locker.

Corrective

Reduce attack impact.

Having ﬁre extinguishers, having
offsite data backups.

Detective

Detect an attack before
happens.

CCTV, intrusion detection
systems (IDS).

Deterrent

Discourages an attacker.

User identiﬁcation andauthentication, fences

Directive

Deﬁne and document
acceptable practices within Acceptable Use Policy (AUP)an organization.

PreventativeObjects are classiﬁed based on control level
using a label.

Access granted for an object.

RecoveryBased on policies deﬁned by a central
authority. Role based or task based.

Stop an attack.

Locks, biometric systems,encryption, IPS, passwords.

Recovery of a system after
an attack.

Disaster recovery plans, data
backups etc.

Vulnerability Assessment
Personnel Testing • Physical Testing • System and Network Testing

Authorization Methods / Concepts

Penetration Testing and Threat ModelingConstrained InterfaceApplications

Restrict actions which can be performed with givenprivileges.

Simulate an attack to determine the probability of the attack to the application
systems

Content-Dependent

Restrict access to data depends on the content of anobject.

1. Record information about the system

Context-Dependent

Granting users access after a speciﬁc condition. Eg.
after speciﬁc date/time.

Work Hours

Context-dependent control

Least Privilege

Subjects are given access to object only to perform
what they need to have.
• No more or no less!

Separation of Duties
and Responsibilities

Tasks split to be performed by two or more people.

User Accountability

Auditing and Reporting • Vulnerability Assessment •Penetration Testing • Threat Modeling

Users are responsible for what actions they haveperformed.
Auditing and Reporting Events to be monitored for reporting: Network Events •Application Events • System Events • User Events •Keystroke Activity

Access Control Types
TypeScope / Purpose

ExampleAdministrativeControls

Administration oforganization assets andpersonal.

Data classiﬁcation, datalabeling, security awarenesstraining.

Logical /Restrict access.
Technical Controls

Physical Controls

Protect organization’sinfrastructure andpersonnel.

Firewalls, IDS’s/ IPS’s,encryption, biometrics, smart
cards, and passwords.
Perimeter security,biometrics and cabling.

Procedure for user account management
Regular user account review and password changes, track access authorization
using a procedure, regularly verify the accounts for active status.

2. Collect information about attack against the system
Steps

3. Discover known system vulnerabilities
4. Perform attacks against the system attempting to gainaccess
5. Document the outcome of the penetration test

Penetration Test Types
Blind TestOrganization knows about possible attack but very limited
knowledge.

Double-BlindTest

Organization doesn’t know about incoming attack except forvery few people in the organization who do not exchange
information.

Target Test

Organization has prior knowledge of the attack, including
key details

Penetration Strategies
Zero-Knowledge
Test

Test team doesn’t know any information about the target
network A.K.A. black box testing.

PartialKnowledge Test

The testing team knows public knowledge about theorganization’s network.

Full Knowledge
Test

The testing team knows all available information regardingthe organization’s network.

Password types
Simple Passwords
Combination / Composition
Passwords

Single word usually a mixture of upperand lowercase letters.
Combination of two unmatching
dictionary words.

Passphrase Passwords

Requires that a long phrase be used.

One-Time or Dynamic Passwords

Passwords that are valid for a single
session login.

Graphical Passwords (CAPCHA)

Uses of character images or graphics
as a part of the authentication.

Numeric Passwords

A password that only uses numbers.