Podcast
Questions and Answers
What is the primary goal of access controls in data security?
What is the primary goal of access controls in data security?
- To control user and system interaction (correct)
- To enable data sharing among users
- To increase system speed
- To monitor network traffic
Which step follows identification in the access control process?
Which step follows identification in the access control process?
- Accountability
- Access Initialization
- Authentication (correct)
- Authorization
Which of the following represents a method of identification in access controls?
Which of the following represents a method of identification in access controls?
- User ID (correct)
- Fingerprint
- Access Rights
- Password
Which access control model is based on the identity of the resource owner?
Which access control model is based on the identity of the resource owner?
What does strong authentication require?
What does strong authentication require?
What is the main purpose of the authorization step in access controls?
What is the main purpose of the authorization step in access controls?
Which factor is NOT considered in the three authentication factors?
Which factor is NOT considered in the three authentication factors?
Which of the following is a characteristic of a good identification method?
Which of the following is a characteristic of a good identification method?
What is the primary advantage of using an RBAC model in a high turnover company?
What is the primary advantage of using an RBAC model in a high turnover company?
Which type of security control is designed to prevent attacks from occurring in the first place?
Which type of security control is designed to prevent attacks from occurring in the first place?
What is a key benefit of maintaining audit trails in security management?
What is a key benefit of maintaining audit trails in security management?
Which password management approach allows users to reset their passwords without administrator intervention?
Which password management approach allows users to reset their passwords without administrator intervention?
Which classification of control specifically aims to restore a system after a disaster?
Which classification of control specifically aims to restore a system after a disaster?
What is considered an example of corrective control in security management?
What is considered an example of corrective control in security management?
In the context of administrative controls, which of the following is a key task?
In the context of administrative controls, which of the following is a key task?
What is a common approach to enhance password security?
What is a common approach to enhance password security?
What is a key characteristic of the discretionary access control (DAC) model?
What is a key characteristic of the discretionary access control (DAC) model?
In a mandatory access control (MAC) model, what is primarily used for access decisions?
In a mandatory access control (MAC) model, what is primarily used for access decisions?
Which type of access control model is organized around the roles held by users?
Which type of access control model is organized around the roles held by users?
How does the MAC model impact a user's ability to manage system settings?
How does the MAC model impact a user's ability to manage system settings?
What role do security administrators play in a MAC system?
What role do security administrators play in a MAC system?
What is a disadvantage of using the DAC model?
What is a disadvantage of using the DAC model?
What does the Role-Based Access Control (RBAC) model rely on for defining user permissions?
What does the Role-Based Access Control (RBAC) model rely on for defining user permissions?
What do MAC systems primarily use to ensure sensitive data is protected?
What do MAC systems primarily use to ensure sensitive data is protected?
Which of the following best describes the purpose of technical controls in security?
Which of the following best describes the purpose of technical controls in security?
What is one of the key functions of physical controls in a security environment?
What is one of the key functions of physical controls in a security environment?
Which of the following actions should be taken as part of access control practices?
Which of the following actions should be taken as part of access control practices?
Which of the following is NOT considered a technical control?
Which of the following is NOT considered a technical control?
What action should be taken with obsolete user accounts according to access control practices?
What action should be taken with obsolete user accounts according to access control practices?
What is a significant risk posed by physical security breaches compared to malware attacks?
What is a significant risk posed by physical security breaches compared to malware attacks?
Which of the following describes the concept of least-privilege access?
Which of the following describes the concept of least-privilege access?
What should be done with inactive accounts after 30 to 60 days?
What should be done with inactive accounts after 30 to 60 days?
Which of the following is NOT one of the top controls to manage security?
Which of the following is NOT one of the top controls to manage security?
What does the principle of least privilege emphasize?
What does the principle of least privilege emphasize?
Which security method focuses on layering multiple defenses to protect systems?
Which security method focuses on layering multiple defenses to protect systems?
What is the main purpose of compartmentalization in security?
What is the main purpose of compartmentalization in security?
Which of the following emphasizes the need to minimize unnecessary applications in a system?
Which of the following emphasizes the need to minimize unnecessary applications in a system?
What does 'keeping things simple' in a security system prevent?
What does 'keeping things simple' in a security system prevent?
Which method uses specific points to analyze and control traffic effectively?
Which method uses specific points to analyze and control traffic effectively?
Which statement describes the concept of 'fail securely/safely'?
Which statement describes the concept of 'fail securely/safely'?
Flashcards
Access Control
Access Control
Security features controlling user and system interaction with resources. It protects resources from unauthorized access.
Identity
Identity
The set of characteristics assigned to an entity to identify it in a computer system.
Identification
Identification
The process of verifying the user's identity.
Authentication
Authentication
Signup and view all the flashcards
Authorization
Authorization
Signup and view all the flashcards
Discretionary Access Control (DAC)
Discretionary Access Control (DAC)
Signup and view all the flashcards
Authentication Factors
Authentication Factors
Signup and view all the flashcards
Strong Authentication
Strong Authentication
Signup and view all the flashcards
Mandatory Access Control (MAC)
Mandatory Access Control (MAC)
Signup and view all the flashcards
Security Label
Security Label
Signup and view all the flashcards
Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC)
Signup and view all the flashcards
Subject
Subject
Signup and view all the flashcards
Object
Object
Signup and view all the flashcards
User Identity
User Identity
Signup and view all the flashcards
Group Membership
Group Membership
Signup and view all the flashcards
Accountability
Accountability
Signup and view all the flashcards
Audit Trails
Audit Trails
Signup and view all the flashcards
Technical Controls
Technical Controls
Signup and view all the flashcards
Preventative Controls
Preventative Controls
Signup and view all the flashcards
Detective Controls
Detective Controls
Signup and view all the flashcards
Corrective/Recovery Controls
Corrective/Recovery Controls
Signup and view all the flashcards
Physical Controls
Physical Controls
Signup and view all the flashcards
Access Control Practices
Access Control Practices
Signup and view all the flashcards
Limit Administrator Accounts
Limit Administrator Accounts
Signup and view all the flashcards
Suspend Inactive Accounts
Suspend Inactive Accounts
Signup and view all the flashcards
Least Privilege
Least Privilege
Signup and view all the flashcards
Defense-in-Depth
Defense-in-Depth
Signup and view all the flashcards
Minimization
Minimization
Signup and view all the flashcards
Keep Things Simple
Keep Things Simple
Signup and view all the flashcards
Compartmentalization
Compartmentalization
Signup and view all the flashcards
Use Choke Points
Use Choke Points
Signup and view all the flashcards
Fail Securely
Fail Securely
Signup and view all the flashcards
Leverage Unpredictability
Leverage Unpredictability
Signup and view all the flashcards
RBAC Model
RBAC Model
Signup and view all the flashcards
Password Aging & Rotation
Password Aging & Rotation
Signup and view all the flashcards
Self-Service Password Reset
Self-Service Password Reset
Signup and view all the flashcards
Deterrent Controls
Deterrent Controls
Signup and view all the flashcards
Corrective Controls
Corrective Controls
Signup and view all the flashcards
Study Notes
Security Controls
- Security controls are safeguards to prevent, detect, correct, or minimize security risks.
- They define actions for data security.
- Types of controls include Administrative, Technical, and Physical.
Administrative Controls
- Develop and publish policies, standards, procedures, and guidelines.
- Manage risk.
- Screen personnel.
- Conduct security awareness training.
- Implement change control procedures.
- Develop policies and procedures to ensure compliance.
Technical Controls
- Implement and maintain access control mechanisms.
- Manage passwords and resource access.
- Employ identification and authentication methods.
- Configure the infrastructure.
- Preventative examples include: encryption, network authentication, ACLs, file integrity auditing, patching, and IPS.
- Detective examples include: security logs, NIDS, HIDS, and IPS.
- Corrective/recovery examples include: restoring from backups and patching.
Physical Controls
- Control individual access to facilities and departments.
- Lock systems and remove unnecessary drives or peripheral devices.
- Protect facility perimeter.
- Monitor for intrusions.
- Employ environmental controls.
- Physical security breaches lead to more problems than just a worm attack.
- USB drives can be easily concealed and used to synchronize files across devices.
- Examples include: automated barriers, building management systems (HVAC, lifts), CCTV, electronic surveillance (EAS), fire detection systems, GIS mapping systems, intercoms, lighting, perimeter intrusion detection systems, radar-based systems, security alarms, video walls, power monitoring systems, and laptop locks.
Access Control Concepts
- Access controls manage user and system communication and interaction with other systems and resources.
- They prevent unauthorized access.
- Parts of access controls include identity, identification, authentication, authorization, accountability, and password management.
Identity
- A set of attributes related to an entity used by computer systems.
- Represents a person, organization, application, or device.
- Identification components require uniqueness, a standard naming scheme, and a non-descriptive approach.
- Attributes should not be shared between users.
Identification
- This is the first step in applying access controls.
- It confirms the entity requesting access is associated with the system's defined role.
- It binds a user to the appropriate controls based on their identity.
- Methods include: User ID, MAC address, IP address, PIN, identification badges, and email address.
Authentication
- The second step in access control, verifying a user's identity.
- Uses information only known to the user.
- Three factors of authentication are something a person knows (knowledge), something a person has (possession), and something a person is (characteristic).
- Strong authentication combines at least two factors.
Authorization
- This step determines what resources a user needs and the type of access allowed.
- Three models include:
- DAC: Discretionary access control, based on user identity.
- MAC: Mandatory access control, based on policy.
- RBAC: Role-based access control, based on roles.
Access Control Models
- Discretionary Access Control (DAC): Owner decides who has access.
- Mandatory Access Control (MAC): Policy determines access.
- Role-Based Access Control (RBAC): Access based on roles.
Accountability
- Users are responsible for their actions.
- Enforces security policies.
- Tracks user, system, and application activities (e.g., audit trails, log files, audit tools).
- Investigates security incidents.
Password Management
- Password security approach considers system versus user generation, strength (length, complexity, and dynamic updates), aging and rotation, and log-in attempts.
- Password management approaches include password synchronization, self-service password reset, and assisted password reset.
Access Control Practices
- Deny access to undefined or anonymous accounts.
- Limit and monitor powerful accounts such as administrators.
- Suspend or delay access following unsuccessful log-in attempts.
- Remove obsolete user accounts.
- Suspend inactive accounts after appropriate timeframes (e.g., 30-60 days.)
- Enforce access criteria (need-to-know, least privilege).
- Disable unused system features, services, and ports.
Top 4 Security Controls
- Application whitelisting
- Patch applications
- Patch operating systems
- Restrict administrative privileges
Commonly Used Security Methods
- Least privilege: Limit access to only necessary resources.
- Defense-in-depth: Layered security mechanisms.
- Minimization: Avoid unnecessary components.
- Keep things simple: Reduce complexity
- Compartmentalization: Divide the system into smaller sections.
- Use choke points: Control access to key areas of the system.
- Fail securely/safely: Minimize damage during failure.
- Leverage unpredictability: Hide specific system details.
- Separation of duties: Different users for different tasks in security.
Midterm Test 1 Details
- Content covers weeks 1 through 5.
- Exam date: February 13, 2024
- Duration: 1 hour and 5 minutes
- Format: Open book, multiple-choice, and written questions.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Related Documents
Description
This quiz covers the essentials of security controls, including administrative, technical, and physical safeguards designed to protect data. Each type of control plays a critical role in preventing, detecting, and correcting security risks. Test your understanding of the policies, mechanisms, and procedures involved in implementing effective security measures.
