Mcse Study Cards

Front 1

What is Information Security Triad?

Back 1

Confidentiality - prevents unauthorized disclosure of sensitive data.
Integrity - guarantees that data and resources are accurate and reliable.
Availability - the timely and reliable access to data and resources by authorized users

Front 2

What is access control?

Back 2

Access control is a security mechanism that prevents unauthorized access to facilities, systems, network resources, and information.

KEY: Access is usually applied based on a user's position/job or a list of rules defining access privileges

Front 3

What are the Access Control goals?

Back 3

Controlling access to data and systems prevents unauthorized users from viewing, modifying, or deleting information. It also prevents authorized users from accidentally modifying or deleting data from a computer network.

Front 4

What is Separation of Duties?

Back 4

It refers to Access Control and dividing tasks between different people to complete a business process. This helps prevent fraud and unauthorized access to data. Example. One person enters payroll and another prints the checks.

Front 5

What are the three categories of Access Control?

Back 5

Administrative Controls - policies, procedures, security awareness training, background investigations

Physical Controls - Includes perimeter security, network separation, data backups, computer controls, lock boxes

Technical Controls - Antivirus software, encryption, transmission protocols, network architecture, passwords, intrusion detection and network access

Front 6

List the Access Control Types

Back 6

Preventive-prevent destruction to property, info/resources
Detective-identify and react to security violations
Corrective-used to restore systems that are attacked Deterrent-Implemented to discourage violations tosecurity
Recovery-used to restore capabilities and resources
Compensation-Established to provide alternatives to other controls

Front 7

What is Mandatory Access Control?

Back 7

MAC is a model that bases access decisions on rules and security labels which consist of a classification and category. MAC is used in areas such as military organizations. In MAC a users security clearance must match the data's security label or access is denied

Front 8

What is Rule Based?

Back 8

Refers to MAC. A rule based model is an access control model in which rules determine an individual's ability to access data and systems. The admin sets the rules and users cannot modify them.

Front 9

What is a Security Label?

Back 9

Refers to MAC. It consists of a classification and a category. In the military "top secret" or "confidential" is a label. It enforces a "need to know" rule. They also perform a 'need to know' to perform a task in order to access secret data.

Front 10

What is Discretionary Access Control?

Back 10

DAC is a model that bases access decisions on who owns the data. Resource owners specify the levels of access users are given. This may user ACL (Access Control List) that specifies which users have what priveledges. An Access Control Matrix is a tabular display of access held by users to an object.

Front 11

What is ACL?

Back 11

Refers to DAC. Access Control List specifies which users have what privileges to a resource. It is bound to an object. This is a basic level of network security. Many OSes, applications, and routers user ACLs.

Front 12

What is Access Control Matrix?

Back 12

Refers to DAC. It displays the access held by users to an object. Each entry displayed in columns and rows represents the type of access. It is a precise way to illustrate users who are permitted to access data.

Front 13

What are permissions?

Back 13

Refers to DAC. Permissions are also referred to as rights. Users are granted read, write and execute permissions to files or folders.

Front 14

What is Non-Discretionary Access?

Back 14

It is is model that bases access decisions on a user's position and job function. It requires the definition of common attributes for each position and the access level. Includes Role Based, Capability Tables

Front 15

What is Role Based?

Back 15

Refers to Non-Discretionary Access Control. Is an access control model in which job roles determine a person's access to data/systems. Also referred to as RBAC. Easy to maintain and manage for companies with high turn-over.

Front 16

What is Capability Table?

Back 16

Refers to Non-Discretionary Access Control. Contains references to subject an displays what objects that subject can access. Presented in columns and rows display individual ACLs.

Front 17

What does Control Data Access do?

Back 17

It provides authorized access to those who need it, when they need it, while protecting your organization's information resources

Front 18

What guidelines should you follow to control data access for your organization?

Back 18

availability requirements - assess accuracy requirements + determine physical, technical and administrative constraints

integrity requirements -prevent modification by unauthorized users, unintentional modification, preserve internal/external data consistency

Consider the confidentiality -is the info sensitive? what degree of sensitivity?

Front 19

What weight is applied to data confidentiality, integrity and availability?

Back 19

It will vary depending on the organization's security policy and the type of data requiring protection.