CID - Access COntrol

Subjects (Users) and sources of access requests are validated through a proper authentication mechanism.

• Reliable input

• Least privilege

• Open Policies

• Closed policies

Closed policy - only accesses that are explicitly stated should be allowed

• True

• True

• False

• False

Open Policy - Authorizations specify which accesses are not prohibited; all other access are not allowed

• True

• True

• False

• False

Resource to which access is controlled

• Object

• Subject

• Access right

• Owner

An entity capable of accessing objects

• Access control

• Subject

• Object

• World

Describe the way in which a subject may access an object

• object

• access control

• subject

• object

What do you understand from figure above

• Authorization control list

• Access Control List

• Capability List

• Object list

What do you understand from figure below

• Object list

• Authorization Control List

• Access Control List

• Capability List

Among the four access control models we saw in this module, which model is more scalable.

• Role-based access control (RBAC)

• Discretionary Access Control (DAC)

• Mandatory Access Control (MAC)

• Attribute-based access control (ABAC)

A subject having an equal or higher security clearance than the object can only access

• Role-based Access control

• Discretionary Access Control

• Mandatory Access Controls

• Role-based Access Control