CYSA + Chapter 8 Identity and Access Management Security

Identities are used as part of the ________ framework that is used to control access to computers, networks and services.

AAA (Authentication, Authorization and Accounting)

_______ is the core identity store and AAA service for many Windows-centric organizations.

AD (Active Directory)

______ is the Microsoft answer to federations. It provides authentication and identity info as claims to third-party partner sites. Partner sites then use trust policies to match claims to claims supported by a service, and the it uses those claims to make authorization decisions.

ADFS (Active Directory Federation Services) Pg 295

Oauth relies on _____ ____ which are issues by an authorization server and then presented to resource servers like third-party web apps by clients.

Access Tokens

The creation, provisioning, maintenance, and de-provisioning and deletion is know as ____ _____ _____

Account life cycle

Common Kerberos attacks? _____ ____ attacks. Kerberos ____ _____ ________-focused attacks

Administrator Account Ticket Reuse (Pass-The-Ticket attacks) TGT (Ticket granting ticket)

What are the three modes of operation that LDAP provide?

Anonymous Unauthenticated Username/Password

____ access control gives users rights based on polices. Logic-Based collections of rights.

Atrribute-based

The ____ associated with and identity include information about a subject and often include the name, address, title, contact info, and other details.

Attributes

CAPTCHA-style methods and account lockout techniques are used to combat against what type of attacks?

Brute-Force attacks

____ attacks focus on getting a user to click a link that causes that user's browser to perform an action as that user.

CSRF (Cross-Site request forgery)

Open ID and OAuth2 is susceptible to ____ attacks.

CSRF (Cross-site request forgery)

What are some common Centralized Identity Management Suites that provide monitoring and privilege management throughout an accounts life cycle and can detect privilege creep?

Centrify Okta SailPoint Ping Identity

What are the four Identity Management systems mentioned in this chapter?

Centrify Okta Sailpoint Ping Identity

What is "The Realm" as it contains to Kerberos?

Consists of groups of principals

User roles and groups, IP Address and reputation, Time of Day, Location, Frequency, and Device-based fingerprint info is common data used for _______ authentication.

Context-Based Pg 284

_______ authentication allows authentication decisions to be made based on info about the user, the sys the user is connecting from, or other info that is relevant to the sys or org.

Context-based authentication

Which access control lacks central access control?

DAC (Discretionary access control)

LDAP _____ attacks disrupt authentication services that rely on LDAP or cause apps and services that rely on LDAP to fail

DOS

_______ _______ are used in networks to provide info about systems, users, and other information about an organization

Directory Services

_______ access control delegate control to the admins or owners of the protected resources like systems or data.

Discretionary

______ _______ of sessions or network links can help reduce the changes of successful MitM attacks.

End-to-end Encryption

Context-based authentication can be combined with MFA, allowing you to require users to provide ________ authentication when additional verification is needed or desired.

Enhanced

____ ____ is a shared authentication system that relies on Facebook credentials for authentication.

Facebook Connect

The process of linking an identity and it's related attributes between multiple identity management systems is know as a _________ ______.

Federate Identity Ex: Using a google account to access sites that aren't hosted by google such as Patreon

______ of Identity info allow the use of Identities outside of your home organization.

Federation

______ systems are Central Management systems that are built to create, store, and manage Identity information as well as the permissions, groups, and other info needed to support the use of identities.

IAM ( Identity and Access Management)

Federated Security from three points of view: As an ______, members of a federation must provide identities, make assertions about those identities to relying parties, and release info to relying parties about identity holders. As the _____ or ____, members of a federation must provide services to members of the federation, and handle data from both users and identity providers securely The ________ or user of the federated services may be asked to make decisions about attribute release, and to provide validation information about their identity claims to the IDP.

IDP (Identity Provider) RP, SP (Relying Party, Service Provider) Consumer

_______ has significant potential security benefits for orgs that don't have a strong in-house identity management capability or that need to better integrate with third-party services.

IDaaS

______ services provide authentication services, typically as a cloud-hosted service.

IDaaS (Identity as a Service)

RADIUS traffic between the RADIUS network access server and the RADIUS server is typically encrypted using _______ tunnels or other protections to protect traffic.

IPsec

______ are the set of claims made about an individual or account holder that are made about one party to another party ( Service provider, application, or system).

Identities

______ _______ create and manage Identities, authenticate and authorize, and Federation of Identity.

Identity Systems

IDaaS provides what six features?

Identity life cycle management Privileged account management and monitoring Directory services Access management (authentication and authorization) SSO via SAML, OAuth, or other standards Reporting and Auditing (Management capabilities) Pg 287

What will a compromise of the KDC allow an attacker to do?

Impersonate any user

Strong Session Handling, Secure Session Identifiers, and End-to-end Encryption can prevent what three kinds of attacks?

Impersonation MitM Session Hijacking

Security issues like "OAuth open redirects" allow what type of attacks to occur?

Impersonation attacks

Common methods of targeting identity and access management systems.

Impersonation attacks MitM (Man in the Middle) Session Hijacking Privilege Escalation Rootkits

What are common LDAP directory server attacks?

Insecure binding (connection) method attacks Improper LDAP access controls LDAP Injections DOS attacks

What authentication protocol does Active Directory use?

Kerberos

Which authentication protocol is designed to operate on untrusted networks and use encryption to protect its authentication traffic?

Kerberos

Which authentication protocol relies on a central key distribution center (KDC)?

Kerberos

MFA relies on what four factors?

Knowledge Possession Biometric Location

_____ is an example of a a commonly deployed directory service. They are frequently used to make available an organizational directory for email and other contact info.

LDAP (Lightweight Directory Access Protocol)

_____ _____ exploits web apps that build LDAP queries using user inputs, allowing attackers to gather additional info or to make changes they shouldn't be authorized to make by OPERATING as the WEB SERVER.

LDAP Injection

One of the most common attacks on web services that use LDAP is _______ ______, which uses improperly filtered user input via web apps to send arbitrary LDAP queries.

LDAP Injections

What are the two flaws mentioned in this chapter that TACACS+ suffers from?

Lack of Integrity checking Encryptions flaws that compromise encryption keys.

A lost phone or token, insecure method of delivering a second factor, or backup access method that allows users to bypass second factor is a weakness of _______.

MFA

______ can help limit the impact of a successful phishing attack by requiring users to take addition action and by providing an authentication with a limited lifespan.

MFA

Common AD attacks include: ________-focused attacks that seek to place credential capturing or exploit-based ________ onto Windows systems or AD servers Credential theft via ______ or other techniques _______ ______ attacks using known or new Windows exploits _____ ______that are often forgotten elements of AD environments and may suffer from both privilege creep and overly permissive rights _____ _____ rights that exist for more staff than is necessary, creating more targets for attackers and a greater likelihood that an AD ______ ______ will not be properly maintained or that it's password will be exposed The use of _____ versions of protocols used in Windows domains like NTLM v1 and LANMAN, NetBIOS, and unsigned LDAP and SMB to capture credentials or to conduct other attacks

Malware Phishing Privilege Escalation Service Accounts Domain Admin Down-Level

_______ access control rely on the OS to control what subjects can access and what actions can be performed. Relies on a sys admin. Typically associated with military systems.

Mandatory

Organizations use ______ ______ processes to validate roles and rights. Sometimes necessary for access control but can require effort and time and are error prone.

Manual Review

When redirects and forwards aren't validated, untrusted user input can be sent to relying web apps, resulting in users being redirected to untrusted sites, allowing phishing scams or permitting attacks to bypass security layers is a flaw of _____ and _____

OAuth OpenID

______ _____ protocol provides an authorization framework designed to allow third part apps to access HTTP-based services. It was developed by IETF. Provides delegation access.

OAuth 2.0

_____ is an open authorization standard used by major websites like Google, Microsoft, and Facebook that allow users to share elements of their ID or account info while authenticating via the "Original" ID provider.

Oauth

_____ is an open source standard for decentralized authentication used by major websites (ID providers) like Google, Amazon, and Microsoft. Users create credentials with one of those ID Providers then sites (relying parties) use that identity.

OpenID

____ ____ is an authentication layer built using the OAuth protocol.

OpenID Connect

_____ _____ is often paired with OAuth to provide authentication. It allows the authorization server to issue an ID token in addition to the authorization provided by OAuth.

OpenID Connect

_____ _____ offers additional protections for encryption, and signing, which can help prevent many of the exploits conducted agains OpenID services.

OpenID Connect

Kerberos attack which reuse a secret key to acquire tickets?

Pass-the-key attacks

Authentication Flow Model Diagram

Pg 281

Context-Based authentication Chart

Pg 285

Comparison of Federated Identity Technologies 1:

Pg 293

Comparison of Federated Identity Technologies 2:

Pg 294

Advanced versions of ________ attacks can replay entries into legitimate sites to prevent their targets from noticing that their login didn't work

Phishing

What are user's called in Kerberos?

Principals

Steady accrual of additional rights over time is known as _____ _____.

Privilege Creep

The practice of managing and controlling identity rights is known as ______ _____

Privilege Management

Which authentication protocol can operate via TCP or UDP and operates in a client-server model?

RADIUS

Which authentication protocol password security isn't very strong?

RADIUS

Which authentication protocol sends obfuscated passwords by a shared secret and MD5 hash?

RADIUS

_____ is one of the most common AAA authentication protocols for net devices, VPNs, wireless nets, and other devices.

RADIUS

_____ access control uses roles associated with job functions or other criteria.

RBAC (Role-Based access control)

Attackers can capture information from you that can be replayed across the net that makes it seem like it's coming from you is called a ______ attack. This attack gathers Session IDs and Credentials and can use that information later on across the net.

Replay

Proper patching, layered security, whitelisting, heuristic detection, and malicious software detection tools can combat against ________

Rootkits

______ combine multiple malicious software tools to provide continued access to a computer while hiding there own existence.

Rootkits

______ access control systems use a set of rules implemented by an admin.

Rule-based

ACL are usually associated with which access control?

Rule-based access control

What technologies can you adopt if you want to Federate your own organization?

SAML OAuth OpenID Connect Facebook Connect

What are four major technologies that serve as the core of Federate Identity that provides a way for identity providers to integrate with service providers in a SECURE manner?

SAML OpenID OAuth2 ADFS

______ is an XML-based language used to send authentication and authorization data between identity providers and service providers. It allows authentication, attribute, and authorization statements to be exchanged. Provides SSO capabilities.

SAML (Security Assertion Markup Language)

Using identity info provides the "who" when reviewing events an incidents when paired with other _______ data and event logs, it provides a complete view of what occurred and what the user, service or account behavior was.

SIEM

______ isn't a secure second factor and NIST 800-63-3 recommends for it to be deprecated.

SMS (Text Message codes sent to your phone)

LDAP and Central Authentication Serice (CAS) is an example of what technology?

SSO

____ reduce the occurence of password reuse and likelihood of credential exposure to third parties. It's cost saving due to fewer password resets and support calls.

SSO

Many web apps rely on _____ systems to allow users to authenticate once and then to use multiple systems or services without having to use different usernames or passwords

SSO (Single Sign On)

Preventing Impersonation attacks can required strong _________ ________ techniques and securing _______ ______

Session Handling Session Identifiers

________ ______ focuses on taking over an already existing session, either by acquiring the session key or cookies used by the remote server to validate the session or by causing the session to pass through a system the attacker controls.

Session Hijacking

RADIUS attacks often focus on the following: _____ _____ of server responses by matching known traffic and replaying previous responses or replaying server responses to authentic client without valid credentials Targeting the RADIUS _____ _____, since RADIUS uses a fixed ______ ____ that can be compromised at the client level _____ attacks aimed to prevent users from authenticating _____ attacks that rely on the use of a RADIUS-shared secret to brute-force the shared secret give a known password

Session replay Shared Secret DoS Credential-based

OpenID, OpenID Connect, Facebook Connect, and OAuth are an example of what type of technology?

Shared Authentication

_____ ______ schemes allow an identity to be reused on multiple sites while relying on authentication via a single identity provider. Ex: Using your Google account to access Patreon

Shared Authentication

______ _____ allows users to use their credentials without having to create new accounts on each site.

Shared Authentication

What's one main difference between Shared Authentication and SSO?

Shared Authentication requires users to enter credentials when authenticating to each site.

Privilege Escalation attacks relies on _____ _____, requiring admins to ensure the local apps, services, and utilities aren't vulnerable.

Software Vulernabilites

The user accounts we use to log in require the ability to uniquely ID individuals and other ______ such as services to allow permissions, rights, group memberships, and attributes to be associated with them.

Subjects

What are three common authentication protocols used for Centralized Authentication Services?

TACACS + RADIUS Kerberos

______ is a Cisco-designed authentication protocol that uses TCP traffic to provide AAA services.

TACACS + (Terminal Access Controller Access Control System) Note: Stupidest name in history.

_______ systems that provide AAA services for network devices should operate on an isolated administrative network if possible due to it's flaws.

TACACS+

____ attacks are incredibly valuable and can be created with extended lifespans. Often called "Golden Tickets" because they allow complete access to the Kerberos-connected systems, including creation of new tickets, accounts changes, and even falsification of accounts or services.

TGT (Ticket-granting ticket)

Using _____ to protect RADIUS authentication instead of relying on the protections built into RADIUS can help mitigate many RADIUS attacks

TLS

What are the common things to consider when implementing a secure LDAP server? Enabling and requiring _________ to keep LDAP queries and authentication secure. Setting _____ _______ to use a secure method because they're normally stored in plain text. Using ______ authentication and requiring TLS ______ of LDAP servers, which can help prevent DOS attacks and other service outages _______ _______ ______ for LDAP, which offer the ability to limit access to specific objects in the directory as well as overall rules for how entries are created, modified and deleted.

TLS Password Storage Password-Based Replication Access Control Lists

What are the three elements that Principals are composed of in Kerberos?

The Primary The Instance The Realm

What is "The Primary" as it contains to Kerberos?

The username

Kerberos _____ _____ allows impersonation of legitimate users for the lifespan of the ticket.

Ticket Reuse (Pass-The-Ticket attacks)

Realms are often separated by _____ ____ and have distinct ________

Trust Boundaries KDC (Key distribution centers)

What is "The Instance" as it contains to Kerberos?

Used to differentiate the primaries