foreign [Music]
Dr Michael Mann and tonight's session review session is on authentication controls
this is of course in preparation for the Security Plus industry certification exam I am using
questions from the Virginia cyber range and we'll go ahead and get started with the first question
okay what does AAA refer to when concerning enforcing security policies AAA
all right let's uh let's take some responses what do you think
thank you one two three or four
if you're not sure is there something that you can see to eliminate fairly quickly
the last option the last option okay and and what makes you want to eliminate that
I agree with you by the way
the rest of the options kind of make sense but the last option has something extra in there
that doesn't really go with cyber security as far as I'm aware sure amelioration yeah
that's uh yeah not exactly um car for the course for cyber security technical language
um and it's not like we're interested in ameliorating anything uh when we're talking
about AAA um is there another choice that doesn't look right
so the third choice starting with access it's close closer than the choice number
four that has the term amelioration in it but really when we're talking about AAA
we're talking about one of the first two choices so which one is it
is it the first choice I know the second choice is it the second choice the second choice
so authentication authorization and accounting okay now what's the
difference between the two choices one and two and it really is just the order in which
the terms are presented however is there anything that is important about the order of the terms
what do you think is it like the steps you have to take the steps have to go a
specific order sure that yes that is that is correct um first you are authenticated
before accessing a resource then based upon your credentials you are authorized to access certain
resources and then finally the accounting part keeps track of basically what you've been doing
so authentication authorization and accounting are the correct answers for this question
um this is it's a little tricky because you look at the first two choices and right and you're in
the exam and you're like well you know they're all the same both saying the same thing um but the
order for this question the order of the answers is important okay let's move on to the next one
okay which of the following is the best example of conditional Access Control
choices one through four a government employee is only allowed to access
information that their security clearance allows them to access or
a user is given access to a certain level of sensitive files based on the project they have
been assigned to choice three an individual who created a document gives access to their friend
for peer review or choice for a subject's account approval is evaluated based on your current
operating system what do you think number two sounds like a viable answer number two is a viable
answer and in fact it is the correct answer yes very well done and what about Choice number one
does that look like conditional Access Control
well no it doesn't it's more closely related to mandatory Access Control
and three is more closely related to discretionary Access Control
and finally the fourth one is more closely resembling rule-based access control so
knowledge of control models is important for dealing with this type of question okay so our
correct answer here is Choice number two a user is given access to a certain level of sensitive files
based on the project they have been assigned to okay let's move on to the next question
this question involves Dynamic code
after entering your username and password in the login screen for your Cloud accounts you click
submit and then a special code that changes every minute is created for you to authenticate yourself
what security measure is deploying this Dynamic code is it TGT totp SMS or certificate Authority
well it helps to know what the acronyms stand for the exam is and the course
as you probably know already is big on acronyms so does anyone know what TGT is
no okay ticket granting ticket TGT are files created by the key
distribution center portion of Kerberos Authentication
what about totp
does anyone know what that one is
okay so t-o-t-p time based one-time passwords and it's a common form of two-factor Authentication
and SMS obviously short message service and certificate Authority so what do you guys think
Choice number one two three or four
um I know it's not number three because it doesn't get sent to the phone so maybe number
two okay and number two is the correct answer this is a time-based one-time password okay
questions about that or does everybody understand applying based one-time password
okay so where would the first one be sent to the
TGT like where would that pop up if you were to so that's something and it's crazy
it's a creative file that would be used and not necessarily sent to a user
in the same way that a time-based one-time password would be oh okay okay
all right let's move on to the next question
multi-factor Authentication
which of the following terms most closely relates to multi-factor Authentication
your choices are token key SSO Pap or HSM they really love their acronyms don't they
you mind um saying what the acronyms are sure so let's start with the first one listed SSO now this
one's pretty widely used does anybody know what this is a single sign-on absolutely it is single
sign-on and single sign-on is not involved with multi-factor Authentication okay how about pap
okay so Pap is password Authentication Protocol and again not related to multi-factor
Authentication um in networking you may have come across this as a point-to-point protocol
used between two routers to authenticate but it's generally considered fairly weak it sends
passwords in plain text and in that context it's typically not used but instead Challenge
hand handshake Authentication Protocol is used in its place and HSM anybody know what that one is
okay so HSM stands for Hardware security module
and this is a hardware card that contains a crypto processor and is used at the hardware level
so just from knowing the definitions of these acronyms it's pretty clear that what's left
is token key and that is most closely related to multi-factor Authentication
so that's our correct answer for this question and we'll move on to the next one
okay security assertion markup language
or saml tokens possess what kind of data after being granted access
okay so does anyone think biometric
no no absolutely not biometric and pkc data
okay so there's it's not involved with public key plain text
so this is security assertion markup language tokens we're talking about
does it make sense that these tokens might have plain Text data
what do you think is that a good choice
no no it is not so our answer for this question is claim data
so saml or saml token possesses encrypted claim data and that's the answer we're looking for here
okay so the next question involving SSH public and private Keys
your organization's network administrator is configuring the Linux servers
SSH Authentication to allow key based Authentication
this setup requires that the private key is blank and the public key is lineage okay so what is SSH
okay nobody got this
all right secure shell
so we're talking about private keys and public Keys your choices are
the private key is kept with the user and the public key is kept with the user
or the private key is kept with the Linux host and the public key is kept with the Linux host
or the private key is kept with the user and the public key is kept with the Linux server
or finally the private key is kept with the Linux host and the public key is kept with the user
what do you think is the correct answer is it the third option the third option okay so the private
key is kept with the user and the public key is kept with the Linux server and that is correct so
probably the easiest way to remember this is that private keys are always kept with the user okay
and so the public key is not
okay now knowing that of course Narrows your answer choices down I have
okay the second choice then is easily eliminated because a private key would not be kept on the
Linux host okay and neither would the fourth choice be a viable Choice as well all right
okay let's move on to the next question
the blank model is used to allocate labels to objects and subjects for Access Control clearances
so um clearly uh the question involves understanding the acronyms listed again
so Let's uh start with that and how about the first one DAC
does anybody remember this one
okay so this is discretionary Access Control how about rbac is that rule-based access
control it's confusing isn't it it could be rule-based could also be something else
anybody know what the other
thing is
so yes we have rules we have discretionary we also have role-based access okay and how about a b a c
okay attribute based Access Control yes attribute based Access Control okay
all right so clearly you need to know something about these different models
to be able to negotiate this type of question
DAC or discretionary Access Control involves granting access by using some type of Access
Control list okay and I'm saying that in a very uh General sense um although the conceptually
Access Control list or ACLs you may have heard of or come across using them in the sense of
firewall rules okay or perhaps even Access Control configured on a router or a switch
and the idea is kind of the same we aren't really or we aren't necessarily talking about
um ACLS on a firewall or a router in this question the question is talking about allocating labels
to objects and subjects now you know if it hadn't said subjects then I would say that it's you know
it could be it could be talking about Network appliances but when you see the term subjects
um what comes to mind
like people yes absolutely like people so that gives us some contextual information
about the question and the answer choices and would also lead me to think that in the second
choice rbac is referring to role base instead of rule based now we go back to discretionary
and as I said access has granted using some type of Access Control list in the general sense of
the term and we've already spoken about how on a network Appliance you can say for example on
a router set up Access Control list to control traffic flows and by the same token um so to speak
um users and groups okay can be granted access to a file for example based on file permissions
okay so the concept of the access control list applies sort of in both domains Network appliances
and also people so now the question is is the description in the question allocating labels
to objects and subjects for Access Control is that a type of discretionary Access Control model
so what do you think yes or no
you have 50 50 chance
anybody want to take a guess I don't know but I'll just say
yes okay well no the answer is no it is not discretionary okay good guess though
um what about role-based access control
does that sound like it could possibly be right
I think role days could be right you think it's right I think so you do okay any particular
reason uh because people could have roles sure that's my kind of connection I'm making
okay and so role based you know is a type of non-discretionary Access Control
um some of the characteristics and it takes a real world approach to structuring access control
and as it sounds it's based on a user's job function within the organization okay
but that doesn't necessarily mean that this model allocates labels so it's not role-based
okay what about attribute based Access Control
I think it's this one okay um because it's attributes and it's saying labels
okay so you're saying the labels that are allocated our attributes yeah they could be
okay so and and I can see why um that could be an appealing answer in fact I might even call this
um a misdirector this is not the correct answer um attributes are often pre-existing
and not handed out necessarily on the Fly which is sort of the implication in this question
um so in ABAC attribute based Access Control
evaluates the attributes or what we could think of as characteristics
rather than roles to determine access okay so and then the purpose for doing this is to protect
objects such as data or network devices and other I.T resources from unauthorized users and actions
in other words if you don't have an approved characteristic as defined by the organization's
security policies then you don't get access so we're left with mandatory Access Control
and um so this is uh where the the allocation of labels comes into play and again knowing
the different models um you know you kind of go through and use the process of elimination
um to negotiate this type of question once again I think it's important to um point out that
acronyms are a large component of this topic not excuse me not just this topic but of the industry
certification exam and it really is important to know them um often I get questions about
you know how to deal um with so many not just pieces of of knowledge-based information that
is as opposed to something that is performance oriented but rather something that is more
straight up knowledge based but also compounded by the fact that there are acronyms and
you know the response is that in the first place you you have to know the acronyms um in
my conversations with students over the years and even for my own purposes um because you know if
I take a an industry certification exam I have to deal with the same thing you do I'm not immune to
um you know the the design of the test makers I I see the same exams you do and for me um doing
something with the information um and it could be something as simple as creating power points
um is helpful because it allows me to do something to create something some information product
using the terms or the acronyms and of course when you're doing this you're going to keep the acronym
and then spell it out so you understand what the meaning is and this type of work I've always found
useful and if you really want to sort of take it to the next level especially when it comes
to creating PowerPoints you can get Jeopardy Style a sort of templates that are pre-made and download
them and use them in PowerPoint and then all you have to do is fill in the content information
so there are two things there that can help you the act of actually doing the work to create
the study tool is is very helpful and then of course using it over and over again to help
with your learning and your studies and when you do this kind of work it really helps you to sort
of internalize the information and once you've done that you know you'll find that recognizing
and understanding and knowing the acronyms becomes a lot easier so okay let's move on
okay so in this question we're talking again about attribute based access control and role based
the question states which comparison between attribute-based and role-based access control
is a true statement your choices are
the ABAC configuration covers more broad access controls whereas our back controls
access on a more detailed level
or number two the ABAC does not include roles in the access control criteria because that is
what the r back is for for number three the ABAC is the most fine-grained type of Access Control
whereas our back is not as precise or finally role-based and attribute based
are on the same level of access controls but they just look at two different parts
okay so what do you think for this question
do you see anything um that could easily be eliminated
okay let's take a look at the second answer
um it states that attribute based access control does not include roles
in the access control criteria because that is what role-based is for
okay so that's not a true statement um attribute based does include information about roles than it
has to because the subject is the user requesting access to a resource to perform an action
okay so that helps us you know with eliminating the second choice
now now if you understand that and you look at the fourth choice role-based and attribute based on
the same level and they really can't be because attribute based includes role-based information
so then that knocks out the poor choice and that leads us with number one or number three
would it be the first one no it would actually be the third and if you
think about it um you know obviously you have to study this and prepare for it but
when we talk about attributes in attributes of something subject an object um
the first answer States that attribute based covers more broad access controls
and the third answer states that attribute base is the most fine-grained or what we
would call a granular has a high level of granularity or type of Access Control
and that is true and in fact that is the correct answer
um attributes or characteristics make up something larger okay so attribute based control
is appropriately named and that answer choice would stand out if you were just trying to look
at this on the basis of elimination based upon what you know and we often use this technique
um that becomes the Clear Choice so it's not a more broad Focus it is a granular Focus okay
all right
okay describing MFA and MFA is what
multi-factor identification yes so that was pretty quick
how were you able to come up with that so quickly I just kind of memorized it
I've heard it thousands of times you've heard it thousands of times thank you you've probably used
it thousands of times as well do you see what I'm saying or what I'm getting at with these acronyms
so most people understand very well what multi-factor authentication is and
you know we use it all the time right we have to use it to get into you know my portal to
get access to things like Canvas OR sis so so it just adds more Credence to the point that
the more you use something the easier it is to recognize it and recall it and deal with it okay
when signing into an account you are told to enter a pin and the last four digits of
your Social Security number to be authenticated does this describe multi-factor Authentication
um not to put to find a point on it but what is a pin what does that acronym stand for
is it personal identification number yes
now this is kind of by the way the sort of opposite end of what I've been saying about
acronyms you can find those that you use so often that you stop thinking about what they mean or
what they're what they stand for with the letter stand for and if that goes on long enough you can
actually forget just an interesting point okay so we're signing into an account we enter a pin we
enter the last four digits of our social security number is that multi-factor Authentication
okay so yes because it is requiring the user to present at least two different credentials
or no because it is not requiring the user to present more than more than two different
credentials or is it yes because it is adding a layer of protection to the Authentication
or Choice number four no because it is not using a combination of different authentication types
okay what do you think
yes first one uh the first one okay anybody else
Morgan uh I I agree with her choice I think that's right I'm sorry I was just reading it
before I said something that's okay so you think it's the first one yeah sir I agree that it's an
example but then I've never the only time I ever think of multi-factor authentication is
like getting a text or an email or something okay so I'm going back and forth okay um hmm
so let me throw out a few phrases for you to consider um something you are
something you have
or something you know does that help
yeah okay what do we think now is it Choice number one two three or four
and remember something you are something you have something you know
so in the question you're told that you're entering a pin
and the last four digits of your Social Security number
given that information
is this answer going to be a yes or a no in terms of multi-factor Authentication
I still say yes okay so we've got one vote for yes yeah I think yes as well
which is probably not the reaction well this is the fun part right we get to talk about it
okay so Morgan did you have a comment yeah I'm I'm confused now I've been confused I'm
not gonna lie but um so we're multi-factor does it have to like like Seth said on like
text and emails does it have to go to something else or is it okay that you
enter it all like on the same device okay like uh same portal like at the same time
okay so it is less dependent on things like the media or devices and it's much more dependent on
is this are they giving you something you are something you have or something you know
let's talk about a pin number okay and we've all come across this in in various applications
um probably one of the more obvious is uh I don't know a credit card pin number or perhaps a debit
card and number and so which category would a PIN number fall into is it something you are
is it something you have or is it something you know something you have okay
so Seth well I've got something you know actually I'm sorry okay I feel like it's a
little bit of both because you you have it and you know it okay I'm guessing I think it is no
okay I had to put into one so let's let's start with that determining which it is because I think
it's pretty clear it's not something that we are but the the confusion seems to be around
is it something you have or is it something you know and you know if you think about it from the
point of view if you when I say pin number if you see your debit card right that kind of makes you
think in your mind that it's something you have okay but you have the credit card right the PIN
is knowledge that you've created in other words I mean most often we choose our own maybe not
initially right if it has to have something they might you know the organization might give
you your pin and go here and remember to change this but a pin is really something we know okay
so is it only something we have if it's tangible yeah okay so what's what is that
so your social security card or your social security number isn't something you have
something you know that's correct
because they're both knowledge based items so then the answer is no
right so too different so it's easy to understand that it's not something you are
um the difference again is between have and and something you know
okay so these are both something you know so what do you think the correct answer is at this point
the second one the second one second choice says no because it is not requiring the user
to present more than two different credentials oh good well multi-factor really means two or more
but wouldn't it be the last one because it's authentic authentication yeah that's correct
I just reread that I'm so sorry no no that's fine that's fine so that's the real problem
here it's not multi-factor because you're not using different authentication types
they're both the same and they have to be different to be multi-factor
okay good morning all right let's move on
okay so this question involves geotagging which of the following is the best example of geotagging
number one a user takes a photo that gets GPS coordinates embedded into it or number two someone
can locate a person's location in real time by tracking the coordinates of their mobile device
or number three a device that can report its location very accurately while Outdoors
or number four a storefront that can send push notifications when you are driving past it
which of those choices is geotagging uh the first one the first one okay anybody else
okay so yeah Seth you're correct it is the first name what is the second one an example of
okay so the term we would use for the second one is geolocating okay first one's
geotagging second one is geolocating what about the third one this is pretty common
you're out taking a long hike or trip through the the wilderness
it's a good idea to have one of these
GPS yes this is describing global positioning system okay because a device that can report
its location accurately Outdoors is a global positioning device and how about the fourth one
okay so the term here that uh the fourth description is um is for is called Geo targeting
okay so geotagging geolocation global positioning and Geo targeting all right okay let's move on
premises to Cloud companies are starting to ship from using on-premises authorization Solutions
to public cloud provider auth Services Solutions how might the change in processes be depicted
your first choice a company's Network that was open to Partners suppliers
and customers is now open to a well-defined group of employees
or the administration of accounts and devices change from being decentralized to centralized
or businesses start using full disk encryption with cloud-based virtual machines instead of
an on-premises virtual machines finally many organizations originally used ldap Technologies
but are now using some type of federation technology
okay so the game is pretty much the same here um when I take certification exams or any kind
of assessment and especially if it's in this format I usually look for something
that can be eliminated pretty quickly so do you see anything like that here
okay do you think it has anything to do with full disk encryption
as we're kind of talking we're not kind of talking the questions talking about
on-premises authorization versus cloud provider or off-premises
okay so the third answer is the one that jumps out is not really having anything to do with this
okay
so that leaves us with one two or four
okay what do you think
can we
thank you I'm sorry go ahead
does number one need to be eliminated as well okay so companies Network that was
open to Partners suppliers and customers is now open to a well-defined group of employees
I don't think that really matters because you can do the same thing whether it's on premises
or using Cloud providers so good number one can be eliminated that leaves us with two or four
okay so if if if these services are provided on premises so it's two oh sorry well
what I was going to say was if they're provided on premises or off
I mean as far as being a decentralized or a centralized service
it's probably not going to be that right because if it's a centralized service and let's say you
know um some type of AAA service on a server okay and you know whether it be tax or radius
um if either of the solutions let's say they're centralized okay
would that necessarily change because we went off premises to the cloud
so so that that answer is kind of weak the best answer is the fourth answer and especially when
they start talking about Federation technology because these type of services are what we
would call and what the Security Plus exam expects you to know as Federated services
and especially when it comes to this this type of authentication and authorization and so the
question is really describing Federation services um and specific that generate access tokens
to provide access anywhere across the internet because that's what the cloud services get us okay
all right
all right SNMP version 3 authentication allows
the use of which hashing algorithm below so your choices are md5 Sha
both a and b or none
this is pretty much a straight up knowledge based question so what do you think
somebody take a guess at it one two three or four three
both are correct okay and again it's almost straight up knowledge base it's
something that you just have to know it can use either md5 or shawl one
um it's also probably useful to know that both of those can be Brute Force to recover
a clear text password so not exactly the strongest type of security okay