Main Topic 11

Blue Team got information about the target

Red Team : know nothing about information
Plan, Discovering, Attack, reporting
Race Condition: is an attack
that depend on the a gap
between authentication and
authorisation

Penetration Testing

TOC/TOU attack that that

interrupt a task and change
something to affect the
resale
Pharma Attach : DNS Poising
Floating Topic
Microprobe Attack : Smart Card attack
Autherization Creep
Network Based , Passive, Profile Update
Check Packet Headre, do not Digital Identity like age, sex
detect atttack from internal Glossary
Federal: Sharing between sites
user
IDS e.g. Flight, Hotels
Host Based System Log, Event Log NIST 80042 Penetration testing
Signature Based ( Behavior based )
Statical Based DAC Identified based based on
Types ACL (Object Resue, Audit trial)

User Information should be taken from HR MAC Rule Based , Labels

User Provision refer to the

creation , maintains and
deactivation of of user
object and attribute
Password Synchronize : User
has one password but has to
authenticate to every system
Self Service password reset
One Time Password ( Dynamic Password)
Provisiong Account Managment
Cogitive password
In Windows used SYKEY Encrypt
the LM Hash in the files and ober
the network
Access Control In Linux and Unix SULT ot
Password Managment NONCE is used to add
randomization to the encryption
process

X500 Standard
Used in LDAP Static Password Owner
Directory Based Authenticate to the token and
Meta gather information from token authenticate to the
different sources and gather information system , User login
them in one place Identify Managment using the token
Allow Administrator to control
what users can access while
browesing WEb Access Managment
Synchronous (TIME BASED)
Work with HTTP Token dynamic use time between the
Password token and the authentication
UPD Raduis server

IEC 14443 Asynchronous (Counter ) A Server

send a non random value to the
token and deliver a one time
password that will be associated
with PIN
Access Control Methodlogy
Smart Cards Challenge/Response Token :
Subtopic 1 Combi Card : also know as The System or workstation will
Dual Interface Card has one provide a challenge and the
smart chip that can be tolan will provide a response
combed with contact pad or 2 Minutes per person enrolment
embaded antenna 10 People per minutes
Finger Print : Store the full
Confedentialility , Intergity, fingerprint, ridges ending
Biometric
Authentication
FingerScan Only the Features
Symmetric Cryptography
Retain Scan : Eye Blood vessels
KDC : Grant Ticket to Client for
IRIS Scan : Color of the portion
a specific server , know all
secret key for the of all client Clipping LEvel : Minimize the
number of attempt to login
and servers
Kerberos
Client Authenticate to the
KDC and get a TGT
Client then access to the TGS using a TGT Single Sign ON
Client then request a ticket How it Work
to the server using his TGT
Then User can use the new
ticket to access the server
Asymetric (PK)
SESAME
Eu
Hieracle Name Schema
Directory Services
Active Directory