Access Control and CIA Triangle Quiz

CIA Triangle

• Confidentiality: Ensures an individual or entity cannot deny performing an action.
• Integrity: Non-repudiation ensures an individual or entity cannot deny having performed a particular action.
• Availability: Ensures resources are accessible when needed.

Access Control Components

• Authentication: Verifying a user's identity.
• Authorization: Determining the extent of access to resources and type of services.
• Access: Successful authentication and authorization allows verified users to access resources.
• Audit: Organizations use audits to collect data on user activities and analyze potential access violations.
• Management: Organizations manage access control systems by adding and removing authentication/authorization for users and systems.

Access Control Models

• Attribute-Based Access Control (ABAC): Access is granted/denied by evaluating rules, policies, and relationships based on user, system, and environmental attributes.

Discretionary Access Control (DAC)

• Data owners determine access to resources based on user ID and ownership.
• Less secure than other models.

History-Based Access Control (HBAC)

• Access is granted/denied based on user history, activities, and request content.
• Examines patterns of behavior over time to mitigate risk.

Mandatory Access Control (MAC)

• Access rights are regulated by a central authority based on multiple security levels.
• Security Enhanced Linux (SELinux) is an example of MAC implementation.

Identity-Based Access Control (IBAC)

• Network administrators can manage activity and access based on individual requirements.

Organization-Based Access Control (OrBAC)

• Allows the policy designer to set security policies independently of the implementation.
• Manages permissions for organizational parts.

Role-Based Access Control (RBAC)

• Access is based on job title.
• Eliminates discretion in granting access.

Risk Management

• Risk = Event Probability of Occurrence x Event Impact
• Risk Assessment: Determine assets, perform risk analysis.
• Risk Control: Implement risk mitigation strategies, monitor risks.
• Qualitative Risk Assessment: Ranks risks subjectively (high, medium, low).
• Quantitative Risk Assessment: Uses numerical data to estimate risk probability and financial impact (ALE = SLE x ARO).

Risk Response Strategies

• Accept: Acknowledge and prepare for consequences.
• Mitigate: Reduce negative impact through safeguards and controls.
• Transfer: Shift risk to a third party.
• Avoid: Eliminate the risk by changing processes or behaviors.

Control Categories

• Administrative (Management): Policies, procedures, guidelines defining personnel and business practices.
• Physical (Operational): Measures to prevent unauthorized access to sensitive material (e.g., alarms, guards).
• Logical (Technical): Technology-based controls to reduce vulnerabilities in hardware and software (e.g., antivirus, firewalls).

Control Types

• Deterrent: Discourages malicious activities (e.g., security policies).
• Preventive: Stops security incidents before they occur (e.g., Intrusion Prevention Systems).
• Detective: Identifies security incidents after they occur (e.g., Intrusion Detection Systems).
• Recovery: Restores systems and data after an incident.
• Corrective: Fixes vulnerabilities.

Security Governance

• Policies, Procedures, Standards, Guidelines: Key elements of security governance.
• Assets: Tangible and intangible resources.

Security Quiz Questions

• Cybersecurity framework development, hacking process without permission, data states, cyber security cube, data storage, countermeasure dimension (involving network availability), and more are included among the questions.