Access Control
Terms
undefined, object
copy deck
- A Hardware token is an example of what kind of authentication?
- Something you Have
-
A password is an example of what kind of authentication?
- Something you Know
-
A Personal Identification Number (PIN) is an example of what type of authentication?
-
Something you Know
- Define "Pass phrase"
- A sequence of characters, longer than the acceptable length of a password, transformed by a password system into a virtual password of acceptable length
-
Define "Password"
-
A private character string that is used to authenticate an identity
- Define: "Authentication"
- Establishes the validity of a subject's claimed identity
-
Define: "Biometrics"
-
A method of verifying an individual's identity based on measurement of the individual's unique and measurable physical features or repeatable actions.
- Define: "Hardware Authentication Token"
- Separate hardware device used for authentication
- Define: "Identification"
- Means in which a user claims unique identity
- Define: "Object"
-
An object is a "data container" or the information or resource that is accessed by subjects
Examples: file, host
-
Define: "Reference Monitor"
- An access control concept that refers to an abstract machine that mediates all accesses to objects by subjects
-
Define: "Type 1 Error"
- False negative (or rejection)
-
Define: "Type 2 Error"
- False positive (or acceptance)
-
Define: "Crossover Error Rate"
-
The point at which the false rejection rate = false acceptance rate
- Define: Access Control
- Collection of Mechanisms that permit managers of a system to exercise a direct or restraining influence over the behavior, use, and content of a system
-
Define: "Subject"
-
Entity that seeks to access information or resources
Examples: user, external host, application
- New passwords should be unchangeable for ___________
-
1 day to 1 week
-
Passwords should be changed every __________ days
- 30 to 90
- The typical recommended minimum length of a password is __________ characters
- 8
- What are the three categories, or types, of Authentication?
-
Something you Have
Something you Know
Something you Are
- What is the only advantage of using passwords over other authentication schemes?
- Cost. There are no other advantages.
- What is the weakest form of authentication?
- Passwordsare the weakest form of authentication
- What is the difference between a synchronous and an asynchronous hardware authentication token?
-
A synchronous token uses a time based or event based to stay in synch with the authentication server
An asynchronous token uses a challenge/response scheme to communicate wit