Page 1041 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

steal user credentials. After attackers have stolen a user’s credentials,

they can launch an online impersonation attack by logging in as the
user and accessing the user’s resources. In other cases, an access
control attack can bypass authentication mechanisms and just steal
the data.

This book covers multiple attacks, and the following sections cover
some common attacks directly related to access control.

Access Aggregation Attacks

Access aggregation refers to collecting multiple pieces of nonsensitive
information and combining (i.e., aggregating) them to learn sensitive

information. In other words, a person or group may be able to collect
multiple facts about a system and then use these facts to launch an
attack.

Reconnaissance attacks are access aggregation attacks that combine
multiple tools to identify multiple elements of a system, such as
Internet Protocol (IP) addresses, open ports, running services,
operating systems, and more. Attackers also use aggregation attacks

against databases. Chapter 20, “Software Development Security,”
covers aggregation and inference attacks that indirectly allow
unauthorized individuals access to data using aggregation and
inference techniques.

Combining defense-in-depth, need-to-know, and least privilege
principles helps prevent access aggregation attacks.

Password Attacks

Passwords are the weakest form of authentication, and there are many
password attacks available. If an attacker is successful in a password
attack, the attacker can gain access to the account and access resources
authorized to the account. If an attacker discovers a root or
administrator password, the attacker can access any other account and
its resources. If attackers discover passwords for privileged accounts
in a high-security environment, the security of the environment can
never be fully trusted again. The attacker could have created other

accounts or backdoors to access the system. Instead of accepting the