SEC+ Flashcards

The idea that information should only be accessible to its intended recipients

The idea that information should arrive at a destination as it was sent.

the idea that information should be available to those authorized to use

Confidentiality, Integrity, Availability

Confidentiality of the information

Type I: What you know (password, pin) Type II: What you have (keycard, key) Type III: What you are (fingerprint, retina scan)

using more than one factor (Type) to ensure a user’s identity

1. Identification: Who is the user? 2. Authentication: Is the user who he says he is? 3. Authorization: What does the user have permission to do?

The system in which a central administrator or administration dictates all of the access to information in a network or system.

The system in which the owners of files actually determine who gets access to the information.

Related to a system in which the roles of users determine their access to files. For example, if Bob is a member of accounting, he should not be able to access the engineering files.

an open-source and widely-accepted method of authentication that works on a shared secret key system with a trusted third party

One is that Kerberos makes extensive use of that trusted third party. If the third party is compromised, information confidentiality and integrity may be breached. If the third party simply fails, availability is lost.

a username and password system.

SSO (single sign on)