Domain 1: Access Control, Pages 9-20

Front 1

Subject

Back 1

An active entity on an organization

Front 2

Object

Back 2

A Passive Data File

Front 3

DAC

Back 3

Discretionary Access Control

Gives the subject full control of the objects they have been given access to

Including: Sharing the objects with other subjects

Front 4

MAC

Back 4

Mandatory Access Control

System-enforced access control based on subject's clearances and object's labels

Front 5

RBAC

Back 5

Role-Based Access Control

Subjects are grouped into roles, and each defined role has access permissions based upon the role

Front 6

Access Control

Back 6

This is the basis for all security disciplines.

The purpose of access control is to allow authorized users access to appropriate data and deny access to unauthorized users.

Front 7

Confidentiality

Back 7

Seeks to prevent the unauthorized disclosure of information: it keeps data secret.

Confidentiality Attack Example: Theft of PII

Front 8

PII

Back 8

Personally Identifiable Information

Any information that could identify a person. Including Credit Cards

Front 9

HIPPA

Back 9

Health Insurance Portability and Accountability Act

This law requires that medical providers keep the personal and medical information of their patients private.

Front 10

Integrity

Back 10

Seeks to prevent unauthorized modification of information

Front 11

What are the two types of integrity?

Back 11

1. Data Integrity

2. System Integrity

Front 12

Data Integrity

Back 12

Seeks to protect information against unauthorized modification

Front 13

System Integrity

Back 13

Seeks to protect a system such as Windows Server 2008 server operating system, from unauthorized modification.

Front 14

Availability

Back 14

Ensures that the information is available when needed.

Front 15

DAD

Back 15

Disclosure Alteration and Destruction

Front 16

Disclosure

Back 16

is the unauthorized disclosure of information

Front 17

Alteration

Back 17

Is the unauthorized modification of data.

Front 18

Destruction

Back 18

Is making systems unavailable.

Front 19

Identity

Back 19

Is a claim.

Example: If you name is PersonX, than you identify yourself by saying I am PersonX.

NOTE: Identity alone is weak because there is no Proof

Front 20

Authorization

Back 20

Describes the actions you can perform on a system once you are identified and authenticated.

Front 21

Accountability

Back 21

Holds Users accountable for their actions.

Front 22

Non-Repudiation

Back 22

Means a user cannot deny (repudiate) having performed a transaction.

Front 23

Least Privilege

Back 23

Means users should be granted the minimum amount of access (authorization) required to do their jobs, but no more.

Front 24

Need to Know

Back 24

The user must need to know that specific piece of information before accessing it.

Example: If Sebastian's Practice is treating a patient, least privilege could allow him access, but need to know would not.

Front 25

What is Defense in Depth often called?

Back 25

Layered Defenses

Front 26

Defense in Depth

Back 26

This applies multiple safeguards (also called Controls) to protect an asset.

Front 27

Control

Back 27

Measure taken to reduce risk

Front 28

IDS

Back 28

Intrusion Detection Systems

This inspects all inbound and outbound network activity and identifies suspicious pattern that may indicate a network or system attack from someone attempting to break into or compromise a system

Front 29

CIRT

Back 29

Computer Incident Response Team

Investigates and resolves computer security incidents.

Front 30

DAC

Back 30

Discretionary Access Control

Gives subjects full control of objects they have been given access to.

INCLUDING: sharing the objects with other subjects

Front 31

What are the 3 most common clearances

Back 31

- Confidential

- Secret

- Top Secret

Front 32

What are some Non-Linux examples of MAC systems

Back 32

- Honeywell's SCOMP

- Purple Penelope

NOTE: These systems were developed under tight scrutiny of the U.S. and British governments.

Front 33

What is a Linux example of MAC system?

Back 33

- LIDS (Linux Intrusion Detection Systems

NOTE: Lids is a hardened Linux distribution that uses MAC.

Front 34

NIST

Back 34

National Institute of Standards and Technology

This is a non-regulatory federal agency under the department of commerce

Front 35

According to NIST:

What are the 3 rules of RBAC?

Back 35

1. Role Assignment

2. Role Authorization

3. Transaction Authorization

Front 36

Role Assignment

Back 36

A subject can execute a transaction only if the subject has selected or been assigned a role.

NOTE: The identification and authorization process is not considered a transaction. All other user activities are conducted through transactions.

Front 37

Role Authorization

Back 37

A subjects active role must be authorized for the subject.

Front 38

Transaction Authorization

Back 38

A subject can execute a transaction only if the transaction is authorized through the subject's role memberships, and subject to any constraints that may be applied across users, roles and permissions.

Front 39

Non-discretionary Access Control

Back 39

Restricting access to objects based on the identity of the subjects and/or groups to which they belong

Front 40

Why is RBAC a type of non-discretionary access control?

Back 40

The users do not have discretion regarding the groups of objects they are allowed to access and are unable to transfer objects to other subjects.

Front 41

What are the 3 types of access control?

Back 41

- DAC: Discretionary Access Control

- MAC: Mandatory Access Control

- Non-Discretionary Access Control

Front 42

Task-Based Access Control

Back 42

This is based on the tasks each subject must perform, such as writing prescriptions, restoring date from a backup tape, or opening a help-desk ticket.

NOTE: This is another non-discretionary access control model.

Front 43

Content and context dependent access controls are __________

Back 43

Not full-fledged access control methods in their own right (as MAC and DAC are), but typically play a defense in depth supporting role.

NOTE: They may be added as additional controls, typically to DAC.

Front 44

Content-dependent access control

Back 44

Add additional criteria beyond identification and authentication: the actual content the subject is attempting to access.

EXAMPLE: An employee can view his/her HR Record but is blocked when trying to access others.

Front 45

Centralized Access Control

Back 45

Concentrates access control in one logical point for a system or organization.

NOTE: This can be used to provide SSO (Single Sign On)

Front 46

Authentication

Back 46

Provide an identity claim

Front 47

Authorization

Back 47

Allowing authenticated subject to sign on a system

Front 48

Accountability

Back 48

Ability to Audit a system and demonstrate the actions of subjects

Front 49

Decentralized Access Control

Back 49

Allow IT administration to occur closer to the mission an operations of the organization.

EXAMPLE: An organization spans multiple locations, and the local sites support and maintain independent system systems, access control databases.

NOTE: On the CISSP exam Decentralized Access Control will be spelled out not to be confused with DAC (Discretionary Access Control)

Front 50

Distributed Access Control

Back 50

This is also known as Decentralized Access Control