SSCP · Domain 2
Access Controls
About 15% of the exam
Authentication methods
- Password
- something known, weakest alone
- OTP token
- time or counter based code
- Smart card
- certificate held on a chip
- Biometric
- something you physically are
- Device certificate
- authenticates the machine itself
- Passwordless
- device key replaces the secret
- Multi-factor
- two different categories together
- Context
- location, time and device posture
Authentication protocols
- PAP
- sends the password in clear
- CHAP
- challenge response, secret never sent
- RADIUS
- UDP, encrypts the password field
- TACACS+
- TCP 49, encrypts the payload
- Diameter
- the successor to RADIUS
- 802.1X
- supplicant, authenticator, authentication server
- EAP-TLS
- certificates on both sides
- Kerberos
- tickets and symmetric keys
Kerberos step by step
- Client asks the authentication service
- KDC issues a ticket granting ticket
- Client presents that ticket
- Service ticket is issued
- Client presents it to the service
- Symmetric keys only, no certificates
- Five minute clock skew allowance
- Kerberoasting cracks service tickets offline
- Forged tickets come from stolen keys
Directory services
- LDAP
- directory queries on port 389
- LDAPS
- the same over TLS, 636
- Distinguished name
- the full path to an entry
- Organizational unit
- container used for delegation
- Group
- rights granted to many at once
- Group policy
- settings pushed to joined machines
- Schema
- attributes an object may hold
Access control models
Discretionary
- The owner grants the access
- Access control lists on objects
- Sprawls easily and audits poorly
- Default on ordinary file systems
Mandatory
- Labels and clearances enforced by system
- No write down, no read up
- Users cannot delegate access
- Bell-LaPadula guards confidentiality
- Biba guards integrity instead
Role, rule, attribute
- Role based follows the job
- Rule based applies if-then logic
- Attribute based weighs many signals
- Subject and object attributes both count
- Risk adaptive tightens as context worsens
Bell-LaPadula protects secrets with no read up and no write down; Biba protects integrity with no read down and no write up
Identity management lifecycle
Proof and provision
- Prove the identity before issuing
- Manager authorizes the request
- Provision from the authoritative source
- Grant by role, not individually
Maintain
- Recertify entitlements on a cycle
- Adjust immediately on transfer
- Watch for accumulated privilege
- Reconcile accounts against real people
Deprovision
- Disable at exit, the same day
- Revoke tokens, keys and certificates
- Reassign ownership of the data
- Delete after the retention period
Trust architectures
- One-way trust
- one domain trusts the other
- Two-way trust
- accepted in both directions
- Transitive trust
- trust flows on to their partners
- Non-transitive
- the trust stops there
- Extranet
- partner access to limited resources
- Third-party link
- contract, scope and monitoring first
- Zero trust
- verify regardless of the network
Federation and single sign-on
- Identity provider
- authenticates and issues assertions
- Service provider
- consumes and trusts the assertion
- SAML
- signed XML assertions for browsers
- OAuth 2.0
- delegated authorization with scopes
- OpenID Connect
- identity layer above OAuth
- SCIM
- provisions accounts across domains
- Metadata
- certificates and endpoints exchanged
- Clock skew
- breaks assertions between partners
Privileged access
- Separate the admin and daily accounts
- Vault credentials and rotate automatically
- Record and review privileged sessions
- Just in time removes standing rights
- Break-glass account sealed and monitored
- Service accounts need named owners
- Never share an administrator password
Biometrics
- False rejection
- a valid user is refused
- False acceptance
- the wrong user is admitted
- Crossover error rate
- where the two rates meet
- Enrollment
- capture of the reference template
- Throughput
- people processed per minute
- Iris
- accurate and contactless
- Retina
- very accurate but intrusive
- Fingerprint
- cheap, affected by dirt
Remote and third-party access
- VPN before any internal resource
- Multi-factor on every remote login
- Jump server as the only path
- Time-limited accounts for contractors
- Log and review third-party sessions
- Close access when the contract ends
Attacks on access control
- Password spraying
- one password, many accounts
- Credential stuffing
- breached pairs tried elsewhere
- Pass the hash
- reuse the hash directly
- Kerberoasting
- crack service tickets offline
- Privilege escalation
- misconfiguration or nested groups
- Session hijack
- steal the token, skip login
- Prompt bombing
- spam approvals until one lands
- Tailgating
- physical entry behind someone
Entitlement review
- The business manager does the review
- Compare rights against the defined role
- Remove access nobody can justify
- Check orphan and dormant accounts
- Record the decision and the evidence
- Exceptions carry an expiry date
Rapid recall
- Subject
- the requester, user or process
- Object
- the resource being requested
- Entitlement
- a right an account holds
- Implicit deny
- unlisted means refused
- SSO
- one login, many services
- Federation
- trust across organizations
- PAM
- control of privileged credentials
- IGA
- governance over entitlements
Reference strip: methods, models, lifecycle, attacks
Methods
- Knowledge, possession, inherence factors
- Smart cards, tokens, passkeys
- Certificate and device authentication
- Context and risk based signals
Protocols
- Kerberos, LDAP, LDAPS
- RADIUS, TACACS+, Diameter
- 802.1X with EAP methods
- SAML, OAuth, OpenID Connect, SCIM
Models
- Discretionary, mandatory, role based
- Rule based and attribute based
- Bell-LaPadula and Biba rules
- Risk adaptive access control
Lifecycle
- Proofing, authorization, provisioning
- Entitlement review and recertification
- Transfer handling and privilege creep
- Deprovisioning and credential revocation
Attacks
- Spraying, stuffing, brute force
- Pass the hash and Kerberoasting
- Session hijack and token theft
- Prompt bombing and tailgating
Quick exam traps
- Trap: Biba and Bell-LaPadula enforce the same rules
- Trap: Two passwords count as multi-factor authentication
- Trap: RADIUS encrypts the whole authentication exchange
- Trap: Kerberos depends on a public key infrastructure
- Trap: Transitive trust stops at the domain you configured
- Trap: Collecting the laptop is the same as revoking access
- Trap: Role based access control prevents privilege creep by itself
cybercertprep.com · original revision sheet written from the public body of knowledge