4 Identity, Access, and Cryptography Free Online FlashCards

What does identity and access management (IAM) do?

Identity and access management (IAM) establishes digital identities, manages credentials, and controls access to resources across the identity lifecycle.

How does role-based access control (RBAC) assign permissions?

In role-based access control (RBAC), permissions are assigned to roles, and users receive access through their assigned roles.

What does single sign-on (SSO) let a user do?

Single sign-on (SSO) lets a user authenticate once to an identity provider and access multiple connected services without entering credentials at each one.

What makes authentication multi-factor?

Multi-factor authentication (MFA) combines two or more different factor types, such as something you know and something you have.

How do symmetric and asymmetric cryptography differ?

Symmetric encryption uses the same secret key to encrypt and decrypt. Asymmetric cryptography uses related public and private keys and is generally combined with symmetric encryption for efficient data protection.

What does a digital certificate bind together, and what does it not prove?

A digital certificate binds an identity, such as a website’s domain name, to a public key. It does not prove that the website or organization is harmless.

How do authentication and authorization differ?

Authentication verifies an identity claim; authorization decides what an authenticated identity is permitted to do.

What is the principle of least privilege?

Least privilege means granting only the access needed to perform assigned tasks.

What information does ABAC use to decide access?

Attribute-based access control (ABAC) evaluates attributes of the user, resource, requested action, and context to decide access.

Why are manually entered one-time codes not necessarily phishing-resistant?

Phishing-resistant authentication binds authentication to the legitimate service. Manually entered one-time codes can still be phished or relayed.

How should systems store password verifiers?

Store password verifiers with a unique salt and a password-hashing scheme designed to slow guessing—not as plaintext or with only a fast general-purpose hash.

What does a plain cryptographic hash not prove?

A plain cryptographic hash can help detect changes when its expected digest is trusted, but it does not authenticate who created the data.