Understanding Access Control

• Access control determines who can access what within a system.
• It protects sensitive information by allowing access to only authorized users.

Key Security Concepts

• Authentication proves identity using methods like passwords or fingerprints.
• Authorization defines permissible actions based on established rules.
• Enforcement ensures rules are followed using firewalls and security tools.
• Logging records actions for security tracking through audit logs.

Types of Access Control

• Physical access control protects physical spaces via locks and biometric scanners.
• Logical access control protects digital data using passwords, encryption, and firewalls.

Protecting Facilities & IT Resources

• Physical security measures include gates, security guards, and electronic locks.
• Logical security uses strong passwords, encryption, and monitoring tools.

Five Key Elements of Access Control

• Identification involves a user claiming an identity with a username.
• Authentication is a user proving their identity, like with a password.
• Authorization lets the system decide what the user can access.
• Auditing tracks system activity.
• Accounting reviews logs for security issues.

Identification, Authentication, and Authorization

• Identification verifies an identity using user IDs or digital IDs.
• Authentication confirms identity using passwords or biometrics.
• Authorization determines access permissions.

Access Control Technologies - Identification Methods

• Identification methods include User IDs, Account Numbers, PINs, Digital IDs, and Access Badges.

Network Identification

• A MAC Address is a unique identifier for a device.
• An IP Address shows a device's network location.
• RFID enables wireless identification with contactless cards.

Identity Management

• Password Management enforces creating strong passwords.
• Account Management organizes user accounts across systems.
• Profile Management stores user information.
• Single Sign-On (SSO) allows users to log in once for multiple apps.

Directory Services

• LDAP manages user authentication and authorization.
• Active Directory (ADDS) controls user identities in a network.

Authentication Methods

• Single-Factor Authentication (SFA) uses one method like a password.
• Multi-Factor Authentication (MFA) uses multiple methods like a password and a fingerprint.
• Soft Tokens are digital authentications stored on a device.
• Hard Tokens are physical devices used for security.
• Biometrics uses physical traits like fingerprints or face scans.

Security Frameworks

• Kerberos is a security system that handles authentication, authorization, auditing, and secure login management with a Key Distribution Center.

Web Portal Access Control

• Web portals are used by organizations to verify users across multiple applications.

Attacker Profiles - Types of Attackers

• A hacker is a tech expert exploring computer systems.
• A cracker illegally breaks into systems.

Types of Hackers

• Black Hat Hackers steal or harm systems.
• White Hat hackers help secure systems.
• Gray Hat hackers do not always follow the rules but don't intend to cause harm.

Common Hacker Types

• Script kiddies use pre-made tools.
• Hacktivists launch attacks for political reasons.
• State-Sponsored Hackers work for governments.
• Cyber terrorists aim to cause destruction or fear.

Why Hackers Attack

• Stealing Data is taking private or company information.
• Denial of Service (DoS) crashes websites.
• Taking Over Systems gains full control of networks.
• Money Fraud involves stealing financial details.

Authentication Process

• Identification occurs when a user claims an identity.
• Credential verification happens when the system checks credentials.
• Validation grants access if credentials are valid.

Authentication Factors

• Type I: Something You Know includes passwords and security questions. It's the weakest form.
• Type II: Something You Have involves smart cards, security tokens, and OTPs.
• Type III: Something You Are uses biometrics like fingerprint or face recognition.
• Type IV: Someplace You Are uses geo-location.

Password Types

• Static Passwords are user-generated and reusable.
• Passphrases are long passwords using phrases.
• One-Time Passwords (OTP) are single-use.
• Dynamic Passwords regularly change.

Tokens & Biometrics

• Soft Tokens are software-based, needing activation.
• Hard Tokens are physical devices storing credentials.
• Biometric Authentication utilizes unique biological features.

Multi-Factor Authentication (MFA)

• MFA uses at least two authentication factors for enhanced security.

Information Security

• Information Security protects data from being stolen, changed, or destroyed.

C.I.A. Triad

• Confidentiality keeps data private and accessible to the right people.
• Integrity ensures data remains correct and unaltered.
• Availability ensures data is accessible when needed.

Common Security Threats

• Malware includes harmful programs like viruses.
• Social Engineering is phishing to steal data.
• Insider Threats are employees misusing access.
• Denial-of-Service (DoS) Attacks overload systems and make them unusable.

Data Protection

• Encryption converts data into a code.
• Access Control limits who can see or change data.
• Backups keep copies of important data.
• Security Training teaches people how to avoid cyber threats.

Security Models

• The D.A.D. Triad (Threat Model) includes disclosure, alteration, and denial.

Best Security Practices

• Use Strong Passwords, not simple or common ones.
• Enable Multi-Factor Authentication (MFA).
• Keep Software Updated.
• Monitor Network Activity.

Why Security Laws are Important

• Organizations must follow legal rules to avoid fines, lawsuits, and reputational damage; ignoring laws leads to negligence.

Major Legal Systems

• Civil Law uses written laws.
• Common Law uses past cases as guides.
• Religious & Customary Law is based on religious texts or traditions.

Types of Laws in Security

• Criminal Law covers crimes like hacking.
• Civil Law handles lawsuits.
• Administrative Law covers government rules.

Intellectual Property Laws

• Trademark protects brand names and logos.
• Patent protects inventions for about 20 years.
• Copyright protects creative works.

Privacy Laws

• GDPR (Europe) protects personal data.
• Data Privacy Act (Philippines) protects private information.

Security Planning

• Security planning is important, it protects sensitive business data, it helps prepare for cyber threats, an ensures legal compliance.

Levels of Planning

• Strategic (5+ years) involves a long-term security strategy.
• Tactical (1-3 years) involves strategies that breaks big goals into smaller tasks.
• Operational (Daily Tasks) focuses on day-to-day measures.

Roles in Security Planning

• CIO makes IT-related decisions.
• CISO focuses on cybersecurity.
• Managers & Technicians handle operations.

Security Planning Approaches

• The Top-Down Approach involves senior management leading.
• Bottom-Up Approach involves IT staff making improvements without central planning.

Security Awareness Training (SETA Program)

• Security Education covers learning principles.
• Security Training focuses on practicing skills.
• Security Awareness works to recognize cyber threats.

Risk Management

• Risk is the chance of something bad happening.

Risk Management Steps

• Identify Risks involves finding weak points.
• Assess Risks involves checking how likely and harmful the risk is.
• Control Risks involves taking steps to reduce threats.

Ways to Handle Risks

• Defense means using strong security measures.
• Transferal involves buying cyber insurance or outsourcing.
• Mitigation involves creating backup plans.
• Acceptance means doing nothing if the risk is low.
• Termination involves removing the risky asset.

Common Cyber Attacks

• Phishing tricks people into giving passwords.
• Malware consists of viruses and spyware.
• DDoS overloads websites.
• Social Engineering manipulates people to gain access.

Hacker Categorization

• Black Hat hackers steal data.
• White Hat hackers improve security.
• Gray Hat hackers break rules but don't intend harm.

Attack Protection

• Use multi-factor authentication and strong passwords.
• Keep software updated.
• Train employees to spot phishing emails and scams.