RBAC vs ABAC Quiz
35 Questions
4 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What does RBAC stand for?

  • Role-Authorized Access Condition
  • Role-Based Access Control (correct)
  • Role-Based Approval Code
  • Role-Assigned Behavior Control

In an RBAC system, a department manager has the right to modify any data within their department.

False (B)

What is a major disadvantage of ABAC as mentioned in the content?

Changing user permissions

In RBAC, user permissions are based solely on the user's assigned __________.

<p>role</p> Signup and view all the answers

Match the role in an RBAC system with their corresponding access level:

<p>Administrator = Full access to the database Department Manager = Access to departmental information Employee = Access to personal data only</p> Signup and view all the answers

Which of the following is true about ABAC?

<p>It considers dynamic attributes for user permissions. (D)</p> Signup and view all the answers

What does the Trusted Computing Base (TCB) primarily consist of?

<p>A combination of hardware, software, and controls (D)</p> Signup and view all the answers

RBAC allows for user permission adjustments based solely on changes in user roles.

<p>True (A)</p> Signup and view all the answers

How does ABAC differ in flexibility compared to RBAC?

<p>ABAC takes dynamic attributes into account, whereas RBAC only considers assigned roles.</p> Signup and view all the answers

A larger TCB provides less flexibility for developers.

<p>False (B)</p> Signup and view all the answers

Name one advantage of a small TCB.

<p>Easier to protect from vulnerabilities.</p> Signup and view all the answers

Three elements that are inside the TCB are: Kernel, _____, and the cryptography component.

<p>authentication mechanisms</p> Signup and view all the answers

Which of the following should probably not be included in the TCB?

<p>Third-party applications (D)</p> Signup and view all the answers

The biggest threat to the TCB is the software it runs.

<p>False (B)</p> Signup and view all the answers

What is a supply-chain attack?

<p>A method of compromising hardware through its external supply sources.</p> Signup and view all the answers

Match the elements with their description regarding the TCB:

<p>Kernel = Core component managing system resources Authentication mechanisms = Methods for verifying user identity Cryptography component = Ensures secure data encryption and decryption Third-party applications = Software not essential to the TCB's core functions</p> Signup and view all the answers

What should the Trusted Computing Base (TCB) be in relation to a system's security needs?

<p>As small as possible, yet adequate (B)</p> Signup and view all the answers

The principle of least privilege suggests that users should be granted maximum privileges to perform their tasks.

<p>False (B)</p> Signup and view all the answers

What can be affected if the authorization mechanism is compromised?

<p>Integrity of the software</p> Signup and view all the answers

If a user can perform administrative tasks without proper authorization, it indicates a possible _____ in the system's security.

<p>vulnerability</p> Signup and view all the answers

Match the following user roles with their respective privileges:

<p>Root user = Can perform all administrative operations Basic user = Limited to standard user tasks Sudo user = Can execute commands with root privileges Attacker = Exploits vulnerabilities to gain unauthorized access</p> Signup and view all the answers

Why is confidentiality important in a system?

<p>To ensure sensitive content is protected (A)</p> Signup and view all the answers

A user granted unauthorized access to change another user's password indicates a well-functioning authorization mechanism.

<p>False (B)</p> Signup and view all the answers

What does the term 'privilege escalation' refer to in system security?

<p>A basic user gaining unauthorized administrative access</p> Signup and view all the answers

What are the two concepts that RBAC-A utilizes?

<p>Static role definition and dynamic attributes (B)</p> Signup and view all the answers

In RBAC-A, permissions are determined at the time of role definition.

<p>False (B)</p> Signup and view all the answers

Name one of the MAC systems used by Linux.

<p>SELinux or AppArmor</p> Signup and view all the answers

In ABAC, the rule format includes 'If the role is ______ and working day is ______...'

<p>teller, Tuesday</p> Signup and view all the answers

Match the following MAC systems with their characteristics:

<p>SELinux = Implements a robust MAC framework AppArmor = Path-based access control RBAC = Role-based access control MLS = Multi-level security enforcement</p> Signup and view all the answers

Which statement accurately describes SELinux?

<p>It combines RBAC, type enforcement, and multi-level security. (C)</p> Signup and view all the answers

AppArmor restricts applications based on roles.

<p>False (B)</p> Signup and view all the answers

What type of permissions can be added or removed in RBAC-A?

<p>Permissions based on dynamic attributes</p> Signup and view all the answers

Signup and view all the answers

Signup and view all the answers

Signup and view all the answers

Flashcards

Trusted Computing Base (TCB)

A collection of hardware, software, and controls working together to enforce a security policy within a computer system.

Large TCB

A larger TCB includes more security mechanisms, such as extensive logging, encryption, and secure communications, offering more comprehensive security coverage.

Small TCB

A smaller TCB, due to its limited components, is easier to secure, has fewer vulnerabilities, and is more portable, making it suitable for integrating into various systems.

Elements within the TCB

The operating system kernel, authentication mechanisms (e.g., biometrics, passwords), and cryptography components (key management, secure encryption/decryption) are essential elements within the TCB.

Signup and view all the flashcards

Elements NOT suitable for the TCB

Third-party applications, activity surveillance mechanisms (e.g., loggers), and unnecessary user applications can increase complexity and introduce vulnerabilities, and are generally not ideal components for the TCB.

Signup and view all the flashcards

Threat to the TCB: Hardware Vulnerability

A significant threat to the TCB is the hardware it relies on. Supply-chain attacks on hardware components can compromise the entire TCB.

Signup and view all the flashcards

Mitigating Hardware Vulnerability

Strict scrutiny of all hardware components entering the company, including scanning and reverse engineering, is a crucial mitigation strategy to ensure hardware reliability and protect against supply-chain attacks.

Signup and view all the flashcards

Security Effectiveness

The degree to which a system's design and implementation can effectively achieve security goals and withstand malicious attacks.

Signup and view all the flashcards

User Privileges

Operations a user can perform based on their role and context. This can include things like reading, writing, modifying files, managing user accounts, or installing software.

Signup and view all the flashcards

Confidentiality

Ensuring that sensitive data, like login credentials, is protected from unauthorized access.

Signup and view all the flashcards

Authorization Mechanism

The mechanism that determines what actions a user is allowed to perform based on their identity and role. It acts as a gatekeeper, deciding who can do what.

Signup and view all the flashcards

Privilege Escalation

A situation where a user gains access to more privileges than they should have. This can happen if the authorization mechanism is flawed or misconfigured.

Signup and view all the flashcards

Principle of Least Privilege

A principle that states that users should only have the minimum privileges necessary to carry out their tasks. This helps to prevent privilege escalation.

Signup and view all the flashcards

Vulnerability

A flaw in the software that could be exploited by attackers to gain unauthorized access or privileges.

Signup and view all the flashcards

Defense in Depth

A security measure that is designed to limit the impact of an attack. It helps to protect the system even if a vulnerability is exploited.

Signup and view all the flashcards

TCB (Trusted Computing Base)

A security policy that is designed to minimize the attack surface, which is the collection of potential entry points that could be exploited by attackers. It involves keeping the system simple and only including essential components.

Signup and view all the flashcards

Role-Based Access Control (RBAC)

A security model where access rights are assigned based on the functions a user performs. Users are grouped into roles, each with specific tasks and permissions.

Signup and view all the flashcards

Attribute-Based Access Control (ABAC)

A access control model where permissions are based on attributes, such as time of day, location, or device used.

Signup and view all the flashcards

RBAC's Strictness

In RBAC, permissions are strictly determined by the assigned role. Any change requires creating new roles based on the new attribute.

Signup and view all the flashcards

ABAC's Flexibility

ABAC adapts to changes more easily by considering dynamic attributes in access control decisions.

Signup and view all the flashcards

ABAC's Efficiency

ABAC can handle changes more efficiently due to its ability to use dynamic attributes, reducing the need for role explosion.

Signup and view all the flashcards

ABAC's Challenges

A main disadvantage of ABAC is the challenge of managing and updating user permissions as attributes change.

Signup and view all the flashcards

RBAC: Simple but Rigid

RBAC is a simpler model for access control, but can be less flexible for dynamic environments.

Signup and view all the flashcards

ABAC: Flexible but Complex

ABAC provides greater flexibility but requires careful management of attributes and their impact on access control.

Signup and view all the flashcards

Role-Based Access Control with Attributes (RBAC-A)

A method of access control where permissions are granted based on user roles, but also dynamically adjust based on changing attributes like time, location, or device.

Signup and view all the flashcards

Dynamic Attributes in RBAC-A

In RBAC-A, a single 'Teller' role can have different permissions based on attributes, like working day and hours. This effectively creates separate roles without defining them explicitly.

Signup and view all the flashcards

Mandatory Access Control (MAC)

A security model that enforces access control based on the type of data and resources, rather than user identities. It's designed to prevent unauthorized access to sensitive information regardless of who the user is.

Signup and view all the flashcards

Security-Enhanced Linux (SELinux)

A MAC system that utilizes a robust framework for enforcing security policies, utilizing RBAC, type enforcement, and multi-level security.

Signup and view all the flashcards

AppArmor

A MAC system that restricts applications to a set of specified resources through path-based access control. It offers a simpler approach compared to SELinux.

Signup and view all the flashcards

SELinux vs. AppArmor

SELinux focuses on enforcing security policies through a comprehensive framework, while AppArmor uses path-based rules to restrict access, offering simplified control.

Signup and view all the flashcards

Contextual Access Control

Depending on the security requirements and specific context, different configurations of access control systems like RBAC, RBAC-A, and MAC (SELinux or AppArmor) may be implemented.

Signup and view all the flashcards

MAC in Linux

Security-Enhanced Linux (SELinux) and AppArmor are examples of MAC systems that are commonly used in Linux operating systems. Both enforce access control but through different mechanisms.

Signup and view all the flashcards

Study Notes

Trusted Computing Base (TCB)

  • TCB is the combination of hardware, software, and controls that work together to enforce computer security policies.
  • A larger TCB offers broader security coverage through more comprehensive security mechanisms (e.g., logging, encryption). This allows for more flexible use due to numerous built-in functions.
  • A smaller TCB is easier to protect because it has fewer components, which decreases vulnerabilities. Smaller TCBs are also portable.
  • Three common elements within a TCB include the kernel, authentication mechanisms (biometrics/passwords), and cryptography components (key management and encryption).
  • Three elements that should not typically be part of a TCB include third-party applications, activity surveillance mechanisms (like loggers), and unnecessary user applications. These add unnecessary complexity and vulnerability.

Authorization & Privilege Escalation

  • User privileges are the operations a user is permitted to perform within a system. These depend on the user's role and context, including actions like reading, writing files, installing/removing software, or managing accounts.
  • Phishing for user credentials does not directly break the authorization mechanism, but instead compromises the confidentiality property of the system.
  • Compromising a piece of software running as root to gain root privileges breaks the authorization mechanism by granting unauthorized access.
  • If an attacker gains the right to change another user's password, the authorization framework is compromised as it grants excessive privileges.
  • A privilege escalation occurs when an attacker manipulates a system to obtain higher-level privileges.

Role-Based Access Control (RBAC)

  • RBAC is an access control model that allows access based on functions a user is permitted to perform.
  • Role-based access controls are defined by functions or roles, and users are assigned these roles. Examples are: administrator, manager, department manager, or employee. These roles determine access levels to data and features.
  • A use case of RBAC is in a company database with financial data. The administrator has full database access followed by progressively narrowed access down to employees, only seeing their data.

Attribute-Based Access Control (ABAC)

  • ABAC allows permissions based on dynamic attributes, including those tied to time of day or context.
  • RBAC is stricter and roles are static, where ABAC is more flexible and allows user permissions to change based on real-time conditions.
  • A potential disadvantage of ABAC is the complexity of changing permissions based on numerous attributes.
  • RBAC-A combines static roles with dynamic attributes in order to avoid ABAC's complexity.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Quiz Team

Related Documents

Assignment 4 PDF

Description

Test your knowledge on Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC). This quiz covers various aspects of these access control models, including their advantages, disadvantages, and components of the Trusted Computing Base (TCB). Challenge yourself to match roles with access levels and understand important security principles.

More Like This

Use Quizgecko on...
Browser
Open
Browser
Browser