SSCP Systems Security Certified Practitioner

An authentication process that allows a user to access multiple independent software systems using a single set of login credentials.

• Enhances user convenience by eliminating repeated logins.
• Can improve security by centralizing authentication and reducing password fatigue.
• Often implemented using protocols like SAML or OAuth.

Cryptographic algorithms designed to be secure against attacks from quantum computers, which could break many of the currently used public-key cryptographic algorithms.

• Aims to replace current public-key cryptography.
• Focuses on algorithms resistant to Shor's and Grover's algorithms.
• Includes lattice-based, code-based, hash-based, and multivariate polynomial cryptography.

A type of encryption that simultaneously provides confidentiality, integrity, and authenticity for data. If any part of the ciphertext or associated authenticated data is modified, decryption and verification will fail.

• Combines encryption with a Message Authentication Code (MAC).
• Protects against tampering, decryption, and replay attacks.
• Examples include AES-GCM and ChaCha20-Poly1305.

Electronic Codebook (ECB) mode for block ciphers encrypts each block independently, leading to identical plaintext blocks producing identical ciphertext blocks, thus revealing data patterns.

• Not suitable for encrypting large amounts of data or data with repeating patterns.
• Often illustrated with the 'Tux' penguin example, where the outline of the penguin remains visible after encryption.
• Should generally be avoided in favor of modes like CBC, CTR, or GCM for most applications.

A trusted entity in a PKI that issues, revokes, and manages digital certificates.

• Root of trust in a PKI.
• Digitally signs certificates it issues.
• Maintains Certificate Revocation Lists (CRLs).

A cryptographic protocol that allows two parties to establish a shared secret key over an insecure communication channel.

• Does not provide authentication by itself.
• Vulnerable to man-in-the-middle attacks without authentication.
• Based on the mathematical difficulty of the discrete logarithm problem.

An authentication method that requires users to provide two or more distinct verification factors to gain access to a resource.

• Significantly enhances security over single-factor authentication.
• Combines different types of factors (knowledge, possession, inherence).
• Commonly used in sensitive applications like banking.

The vulnerability of Electronic Codebook (ECB) mode where identical plaintext blocks are encrypted into identical ciphertext blocks, revealing patterns in the encrypted data and compromising confidentiality.

• Encrypts each block independently.
• No chaining or initialization vector (IV).
• Suitable only for very short, random data (e.g., encrypting other keys).

An authorization mechanism that grants or denies access to resources based on policies that evaluate attributes of the subject, object, action, and environmental conditions.

• Provides highly granular and dynamic access control.
• Scales well for complex environments with many users, resources, and conditions.
• Policies are expressed as 'If-Then' rules based on attribute values.

A system that allows for the portability of identity information across multiple, independent domains, enabling users to authenticate once and access various services without re-authentication.

• Uses trusted identity providers (IdPs).
• Enhances user convenience (single sign-on).
• Reduces administrative burden for service providers.

An access control model where permissions are associated with roles, and users are assigned to appropriate roles based on their job functions.

• Simplifies access management in large organizations.
• Reduces administrative overhead compared to DAC.
• Roles can be hierarchical or constrained.

A symmetric key cipher that encrypts plaintext digits (bits or bytes) one at a time, and whose transformation of successive digits depends on the internal state of the cipher.

• Encrypts data bit by bit or byte by byte.
• Ideal for streaming data, real-time communication, and data of unknown length.
• Requires a keystream generator to produce a pseudo-random sequence.

A type of encryption that simultaneously provides confidentiality (data privacy), integrity (data hasn't been altered), and authenticity (data comes from the expected source). It can also authenticate 'associated data' that is not encrypted.

• Combines encryption and message authentication.
• Prevents common cryptographic implementation pitfalls.
• Often more efficient than separate encryption and MAC schemes.

A property of key agreement protocols that ensures that if one of the long-term keys is compromised, it does not compromise any past session keys derived from it.

• Each session uses a unique, ephemeral session key.
• Session keys are not derived directly from a master secret that could be compromised later.
• Often implemented using Diffie-Hellman key exchange or elliptic curve Diffie-Hellman (ECDHE).

A cryptographic service that provides undeniable proof of the origin or integrity of data, or the identity of the sender, preventing the sender from falsely denying having sent a message or initiated a transaction.

• Prevents denial of origin or action.
• Typically achieved using digital signatures.
• Crucial for legal and financial transactions.

The principle that different cryptographic keys should be used for different cryptographic functions (e.g., encryption, signing, MAC generation) to prevent a compromise of one key from undermining the security of other functions.

• Assigns distinct keys for distinct operations.
• Minimizes impact of key compromise.
• Prevents cryptanalytic attacks that exploit multi-use keys.

A cryptographic technique for securely storing passwords by transforming them into irreversible hash values, combined with a unique, random string (salt) for each password.

• Protects against rainbow table attacks.
• Ensures two identical passwords yield different hash values.
• Makes brute-force attacks more computationally intensive.

A security property within the Bell-LaPadula confidentiality model that prevents a subject from writing to an object that has a lower security classification (no write-down).

• Aims to prevent information from flowing downwards to lower security levels.
• Part of Mandatory Access Control (MAC).
• Crucial for maintaining confidentiality in multi-level security systems.

An access control principle that divides critical functions and responsibilities among multiple individuals to prevent any single person from controlling an entire sensitive process end-to-end.

• Reduces the risk of fraud, error, or malicious acts.
• Requires multiple parties to complete a critical task.
• Often implemented with dual control or two-person rules.

A protocol used to obtain the revocation status of an X.509 digital certificate in real-time. Clients query an OCSP responder for the status of a specific certificate, receiving a signed response.

• Provides real-time certificate revocation status.
• More efficient than CRLs for single certificate checks.
• Reduces network overhead compared to downloading large CRLs.

A rule in the Bell-LaPadula access control model that states a subject at a given security level cannot write to an object at a lower security level (also known as 'no write down').

• Prevents information flow from higher to lower classification levels.
• Crucial for maintaining confidentiality in multi-level security systems.
• Works in conjunction with the Simple Security Property ('no read up').

The cryptographic principle of storing encryption keys separately from the data they protect to prevent unauthorized access to both simultaneously.

• Enhances security by creating multiple points of failure for an attacker.
• Often involves hardware security modules (HSMs) or separate key management systems.
• Crucial for data at rest and data in transit encryption.

An access control model where decisions are made based on the context of the access request, including factors like user identity, time, location, data sensitivity, and the operation being performed.

• Provides highly granular and dynamic access control.
• Considers environmental and situational attributes.
• Often used in environments with complex, changing access requirements.

An access control mechanism that grants or denies access to resources based on a set of predefined rules or policies. These rules often incorporate conditions like time of day, location, or protocol.

• Highly flexible and dynamic.
• Rules are typically defined by administrators.
• Can be used in conjunction with other models like RBAC or ABAC.