identity and access management

identity and access management(IAM)

security process that provides identification, authentication, and authorization mechanisms for users and computers

roles(in the context of IAM)

support the identities of various assets by defining the resources an asset has permission to access based on the function the asset fulfills

password rules

• complexity rules should not be enforced

• aging policies should not be enforced

• password hinst should not be used

password manager

software used to generate a pseudorandom passphrase for each website a user needs to log-on

sigcheck

sysinternals utility that allows to verify root certificates in the local store against microsoft’s master trust list

openSSL

library of software functions supporting the SSL/TLS protocols

federation

process that provides a shared login capability across multiple systems and enterprises

• allows the company to trust accounts created and managed by a different network

• SSO is different: a cryptographic hash of credentials is passed between two systems when dealing with single sign-on

provisioning

creating an account and giving the user authorization to a particular role, application, or file share

passwordless authentication

allows the login to a computer system without entering a password or any other knowledge base secret

biometric impersonation

act of pretending to be another user to bypass a biometric based passwordless authentication system

privilege management

use of authentication and authorization mechanisms to provide an administrator with centralized or decentralized control of user and group role based privilege management

separation of duties

establish checks and balances against the possibility of insider threats

discretionary access control(DAC)

access control model where each resource is protected by an ACL managed by the resource’s owner or owners

mandatory access control(MAC)

access control model where resources are protected by inflexible, system-defined rules where every resources(object) and user(subject) is allocated a clearance level(or label)

role base acces control(RBAC)

access control model where resources are protected by ACLs that are managed by administrators and that provide user permissions based on job functions

attribute based access control(ABAC)

access control technique that evaluates a set of attributes that each subject possesses to determine if access should be granted

audit logs

contains a log of all file access and authentications within a network-based operating system, application, or service

recertification

manual review of accounts, permissions, configurations, and clearance levels at a given interval

code of conduct

a defined set of rules, ethics, and expectations for employees in a particular job role

privileged user agreement(PUA)

a contract with terms stating a code of conduct for employees is assigned based on their higher level permissions on the network and data systems

acceptable user policy(AUP)

a policy that governs employees’ use of company equipment and internet services

which party in a federation provides services to members of the federation?

RP(relying parties) provide services to members of a federation.