Chapter 14 Flashcards
______ refer to the access granted for an object and determine what you can do with it.
a) rights
b) permissions
Permissions
A _____primarily refers to the ability to take an action on an object.
a) rights
b) permissions
right
________ are the combination of rights and privileges.
a) rights
b) permissions
c) Privileges
Privileges
An _________ is a table that includes subjects, objects, and assigned privileges.
access control matrix
ACLs are focused on ______ and a capability table is focused on ______.
objects , subjects
____ ___ ______________ uses multiple
layers or levels of access controls to provide layered security.
defense-in-depth strategy.
_____ allows the owner, creator, or data custodian of an object to control and define access to that object
discretionary access controls (DACs)
Administrators centrally administer _______and can make changes that affect the entire environment. In contrast, __________ models allow owners to make their own changes, and their changes don’t affect other parts of the environment.
nondiscretionary access controls , discretionary access control
What is the difference between DAC and role- BAC ?
In the DAC model, objects have owners and the owner determines who has access. In the role-BAC model, administrators determine subject privileges and assign appropriate privileges to roles or groups.
Which access control model relies on the use of classifilcation labels ?
mandatory access control (MAC)
A ___________ relates various classification labels in an ordered structure from low security to medium security to high security, such as Confidential, Secret, and Top Secret, respectively.
hierarchical environment
A _____ is the possibility or likelihood that a threat will exploit a vulnerability resulting in a loss such as harm to an asset.
a) threat
b) risk
c) vulnerability
risk
A ______ is a potential occurrence that can result in an undesirable outcome.
a) threat
b) risk
c) vulnerability
threat
A _____________ is any type of weakness.
The weakness can be due to a flaw or limitation in hardware or software, or the absence
of a security control such as the absence of antivirus software on a computer.
a) threat
b) risk
c) vulnerability
vulnerability
___________ refers to the process of identifying,
understanding, and categorizing potential threats.
Threat modeling
