CYS406 · Annotated SlidesChapter 2 — Identification, Authentication and Authorization
Chapter 2 · Annotated slides

Identification, Authentication and Authorization

Access-control terminology and principles, the DAC, MAC, RBAC and rule-based models, identity and access management, the types of authentication (password, two-factor, biometrics, smart cards, SSO), authorization and accounting.

Slide text Study notes Highlight: key words Tips, tricks & traps Seen again elsewhere How it can come up
Slide 1: Slide 1
Exam weight Low
    Slide 2: Module Objectives
    Exam weight Low
      Slide 3: Module Flow
      Exam weight Low
        Slide 4: Access Control
        Exam weight Low
        1. Access control: who (subject) can do what (operation) to which resource (object).
        Slide 5: Access Control Terminologies
        Exam weight High
        1. Identification (claim who you are) → Authentication (prove it) → Authorization (what you may do) → Accounting (log what you did).
        Memory trickI-A-A-A: Identify, Authenticate, Authorize, Account.
        🎯 How this can come up · 2 questions
        MCQ

        Entering a username is:

        MCQ

        Deciding which files a logged-in user may open is:

        Slide 6: Access Control Principles
        Exam weight High
        1. Principles: least privilege, separation of duties, need to know.
        🎯 How this can come up · 1 question
        MCQ

        Giving users only the access they need for their job is:

        Slide 7: ❑ Access control models are the standards which provide a predefined framework for implementing the necessary level of access control
        Exam weight High
        1. DAC: the owner decides access. MAC: the system decides by labels/clearances (military). RBAC: by job role. Rule-based: by rules (e.g. time of day).
        🎯 How this can come up · 2 questions
        MCQ

        Access decided by security labels and clearance levels is:

        MCQ

        A file owner granting a colleague read access is:

        Examples of MAC include Security-Enhanced Linux (SELinux) and Trusted Solaris

        Slide 8
        8
        Exam weight Low
          Slide 9: Slide 9
          Exam weight Low
            Slide 10: Slide 10
            Exam weight Low
              Slide 11: Slide 11
              Exam weight Low
                Slide 12: Slide 12
                Exam weight Low
                  Slide 13: Slide 13
                  Exam weight Low
                    Slide 14: Slide 14
                    Exam weight Low
                      Slide 15: Slide 15
                      Exam weight Low
                        Slide 16: Logical Implementation of DAC, MAC, and RBAC
                        Exam weight Low
                          Slide 17: Logical Implementation of DAC, MAC, and RBAC (Cont’d)
                          Exam weight Low
                            Slide 18: Module Flow
                            Exam weight Low
                              Slide 19: Identity and Access Management (IAM)
                              Exam weight Low
                              1. IAM: managing digital identities and their access (provisioning, authentication, authorization, de-provisioning).
                              Slide 20: Identity and Access Management (IAM) (Cont’d)
                              Exam weight Low
                                Slide 21: User Identity Management (IDM)
                                Exam weight Low
                                  Slide 22: User Access Management (AM): Authentication
                                  Exam weight Low
                                    Slide 23: Types of Authentication
                                    Exam weight High
                                    1. Factors: something you KNOW (password), HAVE (token, smart card), ARE (biometric). Two-factor = two DIFFERENT categories.
                                    Exam trapA password + a PIN is still ONE factor (both are something you know).
                                    🎯 How this can come up · 1 question
                                    MCQ

                                    Which is two-factor authentication?

                                    Slide 24: Types of Authentication (Cont’d)
                                    Exam weight Low
                                      Slide 25: Slide 25
                                      Exam weight High
                                      1. Biometrics: fingerprint, face, iris, retina, voice, vein. Errors: false acceptance (FAR) and false rejection (FRR); CER is where they are equal.
                                      🎯 How this can come up · 1 question
                                      MCQ

                                      A biometric system letting in an unauthorized person is a:

                                      Slide 26: Types of Authentication (Cont’d)
                                      Exam weight Low
                                        Slide 27: Types of Authentication (Cont’d)
                                        Exam weight Low
                                        1. Single sign-on (SSO): authenticate once to access many systems.
                                        Slide 28: User Access Management (AM): Authorization
                                        Exam weight Low
                                          Slide 29: User Access Management (AM): Accounting
                                          Exam weight Low
                                            Slide 30: Module Summary
                                            Exam weight Low