+
Related Flashcards
Related Topics
Cards In This Set
| Front | Back |
|
What us CIA?
|
Confidentiality, Integrity, and Availability
|
|
Confidentiality refers to the idea that
|
information should only be accessible to its intended recipients
|
|
Integrity is the idea that
|
information should arrive at a destination as it was sent
|
|
Availability refers to
|
the idea that information should be available to those authorized to use it.
|
|
Type I:
|
What you know – Access control methods related to "what you know" include passwords, numeric keys, PIN numbers, secret questions and answers
|
|
Type II:
|
What you have ,
physical keys or cards, smart cards, and other physical devices
|
|
Type III:
|
What you are,
Some high-tech systems may use fingerprints, retinal scans, or even DNA
|
|
There are essentially three steps to any access control process.
|
1. Identification: Who is the user?
2. Authentication: Is the user who he says he is?
3. Authorization: What does the user have permission to do?
|
|
Authorization is actually achieved between the reference model
|
and the Kernel of the operating system
|
|
What is Kerberos?
|
an open-source and widely-accepted method of authentication that works on a shared secret key system with a trusted third par
|
|
the system in which a central administrator or administration dictates all of the access to information in a network or system
|
MAC: Mandatory Access Control
|
|
the system in which the owners of files actually determine who gets access to the information.
|
DAC: Discretionary Access Control
|
|
a system in which the roles of users determine their access to files
|
RBAC: Role-Based Access Control
|
|
Kerberos uses a Key Distribution Center or KDC to distribute the keys to the parties that wish to communicate then a Ticket Granting Server that
|
allow for the actual communication between the clients by storing authentication information.
|
|
What is one of Kerbos vunerablities?
|
it makes extensive use of that trusted third party. If the third party is compromised, information confidentiality and integrity may be breached. If the third party simply fails, availability is lost.
|
