Access Controls Quiz

Involves limiting what objects can be available to what subjects according to what rules

• Access Control

• Subjects

• Rule

• Object

Any entity that requests access to our assets

Example: A ___ is the initiator of a request for service; therefore, a ___ is referred to as "active".

• Subjects

• Object

• Rule

A device, process, person, user, program, server; client or other entity that responds to a request for service.

Example: An ___ has an owner, and the owner has the right to determine who or what should be allowed access to their ___.

• Object

• Rule

• Subject

An instruction developed to allow or deny access to an object by comparing the validated identity of the subject to an access control list.

Example: When a user (subject) attempts to access a file (object), a ___ validated the level of access, if any, the user should have to that file.

• Rule

• Object

• Subject

Access is based on three elements:

• Subject

  Object

  Rule

• Badge Systems and Gate Entry

  Environment Design

  Biometrics

• Natural Surveillance

  Natural Access Control

  Natural Territory Reinforcement

Describes an information security strategy that integrates people, technology and operations capabilities to establish variable barriers across multiple layers and missions of the organization.

• Defense in Depth

• The Principle of Least Privilege (NIST SP 800-179)

• Privileged Access Management

• Privileged Accounts

Is a standard of permitting only minimum access necessary for users or programs to fulfill their function

• The Principle of Least Privilege (NIST SP 800-179)

• Privileged Access Management

• Privileged Accounts

• Segregation of Duties

Includes role-based specific subsets of privileges that only become active in real time when the identity is requesting the use of a resource or service.

• Privileged Access Management

• Privileged Accounts

• Segregation of Duties

• Two-person rule

Are those of normal users, such as managers and administrators

• Privileged Accounts

• Privileged Access Management

• Segregation of Duties

• Two-person rule

Record of the events occurring within an organization's systems and networks

• Logging

• Audited

• Segregation of Duties

• Two-person rule