cnit270 exam1

What is the CIA triad? Explain each element

• Confidentiality: Only people who are intended to be able to access data can access that data.

• Integrity: Data that was originally written stays the way it was intended.

• Availability: The users should have access to data, are able to access the data when they require access.

What inspired the Parkerian Hexad model?

• Proposed by Donn B. Parker in 1998.

• Parkerian Hexad expands the core concepts of CIA
  and adds a more humanistic touch to account for
  that missing portion of the CIA – Humans.

• Parker believed the six attributes of this model
  gives a more complete framework for thinking
  about security risks, vulnerabilities, and protections
  when compared with the CIA Triad model.

What are the additional 3 elements that the Parkerian Hexad model adds? Explain them

• Non-Repudiation – the lack of ability to deny having
  done something.

• Possession / Control – What happens when
  information is not in the SOLE possession of
  owners? (There is a copy made.)

• Utility / Usefulness - Even if someone has access to data, do they actually require that data?

What is the reasoning behind the AAA model

• Different A’s associated with different security services.

• Intent is to help provide services (CIA) for cybersecurity.

What do the elements in the AAA model represent? Explain

• Accounting/Auditing – Are records being kept? Are they reviewed

• Authentication – Already had this topic. Ensuring the user provides a statement of who they are, and proof of their identity.

  • 2FA – When we are authenticating we need to have 2 different factors of authentication. Example, a password
    and PIN would not count as they are both something you ____.

• Authorization – Asking the question, are you allowed to be here? Are you allowed to do that?

What is the background info of access control? Just explain what it is

• Can be implemented through technological and/or procedural means

• Access control implements a security policy that specifies who or what (e.g., in the case of a process) may have access to each specific system resource and the type of access permitted in each instance

permission sprawl

The gradual accumulation of access rights beyond what users need, typically caused by permissions being granted but never revoked. This violates least privilege and increases security risk.

granularity

The level of precision or detail at which access control decisions can be made. Fine-grained systems control access to specific fields or actions, while coarse-grained systems control access at broader levels like entire applications or roles.

context awareness

The ability of an access control system to consider environmental factors—such as time, location, device, or risk level—when making authorization decisions

role explosion

The uncontrolled proliferation of roles in an RBAC system, often caused by creating new roles to handle every exception or unique permission combination. This defeats RBAC's administrative simplicity and becomes unmanageable at scale.

what are the access control policies? just list them

• Discretionary Access Control (DAC)

• Mandatory Access Control (MAC)

• Role-Based Access Control (RBAC)

• Attribute-Based Access Control (ABAC)

what is discretionary access control (DAC)

• Typically seen on the *nix systems (Unix/Linux)

• Discretionary in this instance means that the owner of the resource (file, program, etc.) has the ability to grant permission to other resource users.

DAC pros/cons

pros:

• simple to implement and understand

• flexible (highly granular)

• low admin overhead

• native to most OS’

• good for collaboration

cons:

• vulnerable to trojan horse attacks (malware inherits user permissions)

• no centralized control

• difficult to enforce organization wide policies

• permission sprawl as users share access liberally

• challenging to audit

mandatory access control (MAC)

• No discretion involved. You have access depending on your level of clearance.

• Commonly seen in USA government where your clearance level will determine what you can/cannot see and do on their systems.

  • Examples of clearances: Confidential, Secret, Top Secret, Top Secret (Sensitive Compartmented Information)

MAC pros and cons

pros:

• strong against data leakage

• centrally enforced

• prevents unauthorized info flow between classification levels

• works well for strict confidentiality environments

• immune to trojan horse attacks from DACL

cons:

• rigid and inflexible- difficult to customize when needed

• high administrative burden to classify all objects/subjects

• can hinder productivity and collaboration (shown above)

• complex to implement correctly

• too much for most commercial environments (more security implemented than people will tolerate)

role-based access control (RBAC)

• Often, there are large companies who have a need to have a certain type of role for the software to access the software where others do not.

  • Example: HR employees have access to software for tracking employees and salaries, where not
    every employee needs this access.

• Think about a company that is worldwide with literally tens of thousands of employees. It would be nearly impossible to set individual access rights. This really helps control large systems and helps with audits.

rbac pros and cons

pros:

• intuitive- maps alongside a company org structure

• simplifies administration through role assignment

• easy on/offboarding

• supports separation of duties and least privilege

• good audit trail and widely supported in enterprise

cons:

• role explosion in complex orgs (too many roles to securely manage)

• doesn’t handle exceptions well without creating a new role

• static- doesn’t take into consideration context (time, location, device)

• requires lots of planning before implementation

• requires occasional review to ensure alignment with company org structure

attribute based access control (abac)

• takes into consideration: user, system resource, and environment

• Attributes could include something like clearance level of files, if we have a small set of top-secret files, we don’t need to implement a full MAC, we could make it an attribute.

abac pros and cons

pros:

• Extremely flexible and granular

• Context-aware (time, location, device, risk level)

• No role explosion

• Handles, complex, dynamic access scenarios

• Scales well, supports fine-grained compliance
  requirements

cons:

• Complex to design, implement, troubleshoot

• Policy language can be difficult to understand

• Big learning curve / requires robust attribute
  management infrastructure.

• More difficult to audit than others. Having to
  answer the question of “why” access was granted
  to individuals and maintain that documentation.

• Performance overhead from real-time attribute evaluation

main difference between rbac and abac

• RBAC answers the question – What is your job title/function?”

• ABAC answers “What are the relevant characteristics of you, the resource, and the current context?”

rbac/abac differences in decision basis, granularity, context awarenedd, why was access granted, and scalability challenge

context is required for…

• Continuous authentication – opposes the one-time login. AI monitors the entire session of a user.

• Risk-based Access – Permissions dynamically adjust based on real-time risk scores

• Zero-Trust Architectures – Never trust, always verify”

• User and Entity Behavior Analytics (UEBA) – AI baselines normal behavior and flags deviations

subject

an entity capable of accessing objects; can be a human user, software, engineer, e.t.c.

• three classes: owner, group, and world

object

resource to which access is controlled; entity used to contain and/or receive info

access right

describes way in which subject may access an object

• can include read, write, execute, delete, create, search

discretionary access control *nix demo

• 9 bits displayed always represent read, write, execute in that order

• overlaid with 3 additional special bits

• always represents owner permissions, group owner permissions, then rest of universe in that order

special bits- permission bits

• set user id (setuserid)

• set group id (setguid)

• sticky bit

• in *nix system, superuser/administrator (aka root, wheel) is exempt from access control restrictions

authentication

1. who am i and 2. proof i am who i claim to be

• what you know, what you are, what you have, and where you are

how is leet speak not secure

• It doesn’t take long to break a password.

• These are typically now just built in for most people’s password lists.

What does NIST suggest for passwords

• enable all ascii chars (all unicode chars including emojis)

  • 0-31 – Unprintable control codes – used to control peripherals, such as printers. Not good for pwd.

  • 32-127 – Standard ASCII characters, represent letters, digits, punctuation marks, and a few miscellaneous
    symbols.

  • 128-255 – Extended ASCII characters, represent a wide variety of areas including ‡ (double dagger), ©
    copyright sign, Latin letters, – en dash, — em dash, and many more.

how does NIST feel about expiring passwords

• NIST suggests not expiring passwords (requiring a password to be changed by the user in a certain timeframe).

• Suggesting the only time a password should be expired is if it is exposed in a data breach.

• One issue with frequent password changes is users’ coping strategies (adding a number, moving a number to the front or back of the existing password, etc.).

how does NIST feel about password hints and questions

None

• users may try to put their password in the hint

• anyone who knows OSINT or target can easily answer questions and good OSINT will provide us with the answers quickly

why is SMS bad for authentication, according to NIST

usually not encrypted, although changing with new methods like RCS

• still better than nothing