Ch. 3 - Access Control Concepts Flashcards
Understand Access Control Concepts:
Access is based on all of the following except:
A. Subjects (Who)
B. Objects (What)
C. Rules (How and When)
D. Reason (Why)
D. Reason (Why)
Understand Access Control Concepts:
- An information security strategy that integrates people, technology and operations capabilities to establish variable barriers across multiple layers and missions of the organization.
- Applies multiple countermeasures in a layered fashion to fulfill security objectives.
- Should be implemented to prevent or deter a cyberattack, but it cannot guarantee that an attack will not occur.
All of the following support:
A. Access Control
B. Defense in Depth
C. Privileged Access Management
D. User Provisioning
B. Defense in Depth
Understand Access Control Concepts:
- Reduces risk by allowing admin privileges to be used only when needed.
- Provides confidentiality by limiting the need for administrative access that is used during routine business.
- Ensures integrity by only allowing authorized administrative access during approved activities.
- Confirms availability by providing administrative access when needed.
All of the following support:
A. Access Control
B. Defense in Depth
C. Privileged Access Management
D. User Provisioning
C. Privileged Access Management
Understand Access Control Concepts:
- New employee – account created
- “Onboarding” – creating an account (or cloning a baseline account) for a new employee
- Changed position – account modified
- Temporary leave of absence – account disabled
- Separation of employment – account deleted
- “Offboarding” – deleting an account (or disabling then deleting an account) for a terminated employee
All of the following support:
A. Access Control
B. Defense in Depth
C. Privileged Access Management
D. User Provisioning
D. User Provisioning
Access Controls:
The following are examples of what type of access control?
Security guards
* Fences
* Motion detectors
* Locked doors/gates
* Sealed windows
* Lights
* Cable protection
* Laptop locks
* Badges
* Swipe cards
* Guard dogs
* Cameras
* Mantraps/turnstiles
* Alarms
A. Physical Access Controls
B. Logical/Technical Access Controls
C. Administrative Access Controls
D. Temporary Access Controls
A. Physical Access Controls
Access Controls:
All of the following are types of Logical Access Controls except.
A. Discretionary access control (DAC)
B. Technical Access Controls (TAC)
C. Mandatory access control (MAC)
D. Role-based access control (RBAC)
B. Technical Access Controls (TAC)
Definitions:
Information security strategy integrating people, technology, and operations capabilities to establish variable barriers across multiple layers and missions of the organization.
A. Defense in Controls
B. Defense in Layers
C. Defense in Depth
D. Defense in Steps
C. Defense in Depth
Source: NIST SP 800-53 Rev 4
Access Controls:
A certain amount of access control is left to the discretion of the object’s owner, or anyone else who is authorized to control the object’s access. The owner can determine who should have access rights to an object and what those rights should be.
A. Discretionary access control (DAC)
B. Technical Access Controls (TAC)
C. Mandatory access control (MAC)
D. Role-based access control (RBAC)
A. Discretionary access control (DAC)
Source: NIST SP 800-192
Access Controls:
Access control that requires the system itself to manage access controls in accordance with the organization’s security policies.
A. Discretionary access control (DAC)
B. Technical Access Controls (TAC)
C. Mandatory access control (MAC)
D. Role-based access control (RBAC)
C. Mandatory access control (MAC)
Access Controls:
An access control system that sets up user permissions based on responsibilities.
A. Discretionary access control (DAC)
B. Technical Access Controls (TAC)
C. Mandatory access control (MAC)
D. Role-based access control (RBAC)
D. Role-based access control (RBAC)
Definitions:
Devices that enforce administrative security policies by filtering incoming traffic based on a set of rules.
A. Firewalls
B. Routers
C. Switches
D. Hubs
A. Firewalls
Definitions:
An entity with authorized access that has the potential to harm an information system through destruction, disclosure, modification of data, and/or denial of service.
A. Outsider Threat
B. Insider Threat
C. Threat Vector
D. Threat Asset
B. Insider Threat
Definitions:
Collecting and storing user activities in a log, which is a record of the events occurring within an organization’s systems and networks.
A. Documenting
B. Stacking
C. Collecting
D. Logging
D. Logging
Source: NIST SP 1800-25B
Definitions:
An automated system that controls an individual’s ability to access one or more computer system resources, such as a workstation, network, application or database. It requires the validation of an individual’s identity through some mechanism, such as a PIN, card,
biometric or other token. It has the capability to assign different access privileges to different individuals depending on their roles and responsibilities in an organization.
A. Logical Access Control Systems
B. Physical Access Control Systems
C. Administrative Access Control Systems
D. Logical Process Controller Systems
A. Logical Access Control Systems
Source: NIST SP 800-53 Rev.5
Definitions:
An entrance to a building or an area that requires people to pass through two doors with only one door opened at a time.
A. Piggybacking
B. Mantrap
C. Mancave
D. Man-in-the-Middle
B. Mantrap
