3) Authorization and Access Control

Question 1

What dictates that we should only allow the bare minimum of access, as needed?

Answer 1

Principle of least privilege

Question 2

Restricting access to resources.

Answer 2

Denying access

Question 3

Giving access to resources.

Answer 3

Allowing access

Question 4

Partial access to resources.

Answer 4

Limiting access

Question 5

(T/F) Access controls are policies or procedures used to control access to certain items.

Answer 5

True

Question 6

Access to a resource is determined by the resource owner.

Answer 6

Discretionary access control

Question 7

Access to a resource is determined based on job duties.

Answer 7

Role-based access control

Question 8

Access to a resource is determined by a group or an individual who has the authority to decide who gets access.

Answer 8

Mandatory access control

Question 9

Access to a resource is determined by the traits of a person, resource, or an environment.

Answer 9

Attribute-based access control

Question 10

What is implemented through the use of access controls?

Answer 10

Authorization

Question 11

Enables us to determine what users are allowed to do.

Answer 11

Authorization

Question 12

States that we should allow only the bare minimum access required in order for a given party to perform a needed functionality.

Answer 12

Principle of least privilege

Question 13

The act of doing something that is prohibited by a law or rule.

Answer 13

Violation

Question 14

An act that grants a particular party access to a given resource.

Answer 14

Allowing access

Question 15

An act that prevents a party from accessing something, such as logging on to a machine or entering the lobby of our building after hours.

Answer 15

Denying access

Question 16

An act that allows some access to a given resource, but only up to a certain point.

Answer 16

Limiting access

Question 17

A set of resources devoted to a program, process, or similar entity, outside of which the entity cannot operate.

Answer 17

Sandbox

Question 18

The ability to remove access from a resource at any point in time.

Answer 18

Revocation

Question 19

Typically built to a certain resource, these contain the identifiers of the party allowed to access the resource and what the party is allowed to do.

Answer 19

ACLs

Question 20

ACLs are typically built to a certain resource, they contain the identifiers of the party allowed to access the resource and what the party is allowed to do. What does ACL stand for?

Answer 20

Access control list

Question 21

In this method of security, a person’s capabilities are oriented around the use of a token that controls their access.

Answer 21

Capability-based security

Question 22

A type of attack that is more common in systems that use ACLs rather than capabilities.

Answer 22

The confused deputy problem

Question 23

A type of attack that misuses the authority of the browser on the user’s computer.

Answer 23

CSRF

Question 24

CSRF is a type of attack that misuses the authority of the browser on the user’s computer. What does CSRF stand for?

Answer 24

Cross-site request forgery

Question 25

A client-side attack that takes advantage of some of the page rendering features that are available in newer browsers.

Answer 25

Clickjacking

Question 26

Access is determined by the owner of the resource in question.

Answer 26

DAC

Question 27

DAC is determined by the owner of the resource in question. What does DAC stand for?

Answer 27

Discretionary access control

Question 28

Similar to MAC in that access controls are set by an authorized person responsible for doing so, rather than by the owner of the resource. In this model, access is based on the role the individual is performing.

Answer 28

RBAC

Question 29

RBAC is based on the role the individual is performing. What does RBAC stand for?

Answer 29

Role-based access control

Question 30

Access is based on attributes.

Answer 30

Attribute-based access control

Question 31

Attributes of a particular individual.

Answer 31

Subject attributes

Question 32

Attributes that relate to a particular resource.

Answer 32

Resource attributes

Question 33

Attributes that relate to environmental conditions.

Answer 33

Environmental attributes

Question 34

Designed to prevent conflicts of interest. Three main resource classes are considered in this model: objects, company groups, and conflict classes.

Answer 34

The Brewer and Nash model

Question 35

A combination of DAC and MAC, primarily concerned with the confidentiality of the resource. Two security properties define how information can flow to and from the resource: the simple security property and the * property.

Answer 35

The Bell-LaPadula model

Question 36

Primarily concerned with protecting the integrity of data, even at the expense of confidentiality. Two security rules: the simple integrity axiom and the * integrity axiom.

Answer 36

The Biba model

Question 37

A method by which a person follows directly behind another person who authenticates to the physical access control measure, thus allowing the follower to gain access without authenticating.

Answer 37

Tailgating

Question 38

Access controls that regulate movement into and out of buildings or facilities.

Answer 38

Physical access controls

Question 39

An access control model that includes many tiers of security and is used extensively by military and government organizations and those that handle data of a very sensitive nature.

Answer 39

Multilevel access control model

Question 40

Access is decided by a group or individual who has the authority to set access on resources.

Answer 40

MAC

Question 41

MAC is decided by a group or individual who has the authority to set access on resources. What does MAC stand for?

Answer 41

Mandatory access control

Question 42

A client-side attack that involves the attacker placing an invisible layer over something on a website that the user would normally click on, in order to execute a command differing from what the user thinks they are performing.

Answer 42

Clickjacking

Question 43

What type of access control can prevent the confused deputy problem.

Answer 43

Capability-based security

Question 44

Confidential Services Inc. is a military-support branch consisting of 1,400 computers with Internet access and 250 servers. All employees are required to have security clearances. What access control model would be most appropriate for this organization?

Answer 44

Mandatory access control

Question 45

A user who creates a network share and sets permissions on that share is employing which model of access control?

Answer 45

Discretionary access control

Question 46

A VPN connection that is set to time out after 24 hours is demonstrating which model of access control?

Answer 46

Attribute-based access control