Chapter4 Flashcards
The prevention of unauthorized use of resource, including the prevention of use of a resource in an unauthorized manner
Access Control
Verification that the credentials of a user or other system entity are valid
Authentication
The granting of a right or permission to a system entity to access a system resource.
Authorization
An independent review and examination of system records and activities in order to test for adequacy of system controls
Audit
Access control policies are generally grouped into following categories
- Discretionary access control (DAC)
- Mandatory access control (MAC)
- Role-based access control (RBAC)
Control access based on the identity of the requestor and on access rules (authorizations) stating what requestor are (or are not) allowed to do.
Discretionary access control (DAC)
Control access based on comparing security labels with security clearances
Mandatory access control (MAC)
controls access based on the roles that users have within the system and on rules stating what accesses are allowed to users in given roles
Role-based access control (RBAC)
dictates what types pf access are permitted and by whom
access control policy
Traditional method of implementing access control
DAC
Access Control Requirements:
- Reliable input
- Support for fine and coarse specifications
- Least privilege
- Separation of duty
- Open and closed policies
- Policy combination and conflict resolution
- Administrative Policies
- Dual Control
basic elements of access control
- subject
- object
- access right
It is an entity capable of accessing objects
subject
classes of subjects
- Owner
- Group
- World
it is a resource which access is controlled
object
