3 Access Control

Question 1

Physical Access Control
Goals (3)

Answer 1

1 limit access to facilities
2 authenticate employees seeking access
3 tracking visitors and contractors who access the site

Question 2

CPTED =

Answer 2

Crime Prevention Through Environmental Design

Question 3

CPTED Goals (3)

Answer 3

1 Natural Surveillance (good visibility)
2 Natural Access Control (gates - funnel)
3 Natural Territory Reinforcement (obvious that an area is closed - signs)

Question 4

Two-Person Integrity

Answer 4

requires that 2 people must be present to enter a secure area

Question 5

Two-Person Control

Answer 5

requires concurrence from 2 people to carry out an action

Question 6

Segregation of Duties

Answer 6

• requires that a single person can’t perform two separate actions, which when combined, might pose a business risk (edit payroll data AND issue checks)

Question 7

Logical access control =

Answer 7

Account and Privilege Management

Question 8

Managing the account lifecycle (5 stages)

Answer 8

1 Provisioning new user
2 assigning roles/permissions
3 modifying roles/permissions (for job changes)
4 reviewing access
5 de-provisioning (removing the access) of terminated users

Question 9

Account Monitoring -things to implement/watch out for (3)

Answer 9

1 Inaccurate Permissions
2 User Account Audit
3 Unauthorized use of permissions

Question 10

Access Policy Violations red flags (5)

Answer 10

1 impossible travel time logins (home and Eastern Europe)
2 logins from unusual network locations (HR on guest network)
3 unusual time-of-day logins
4 deviations from normal behavior
5 deviations in volume of data transferred

Question 11

Geofencing

Answer 11

• alerts when a device leaves defined boundaries

Question 12

2 main benefits of Least Privilege

Answer 12

1 minimizes the potential damage from an insider attack
2 limits the ability of an external attacker to quickly gain privileged access when compromising an employee’s account (unless its a system administrator account)

Question 13

Access Control Systems/approaches (3)

Answer 13

1 Mandatory Access Control (MAC)
2 Discretionary Access Control (DAC)
3 Role-based Access Control (RBAC)

Question 14

MAC =

Answer 14

• OS makes decisions by comparing user labels with resource labels

Question 15

DAC =

Answer 15

• file owners have the discretion to configure user permissions as they see fit

Question 16

3 Role-based Access Control (RBAC)

Answer 16

• administrators create job-based roles and assign permissions to those roles