Domain 1: Access Controls Flashcards
Physical Controls
Doors, Locks, Fences, etc
Logical Controls
ACL’s, IDS, FW, routers, Virus protection, activity logging
Administrative controls
Baners, Signs, policies, Procedures, directives, rules & regs, documents or log-on screens
The types of controls
Physical, Logical , Administrative
Physical Assets
Tangible things such as the building, property, business, equipment, and people
Digital assets
Generally consist of the data contained or stored on the IT systems
Information assets
The content information represented by the digital data
Most important asset to protect
People
Assurance procedures
Procedures that ensure that the access control mechanisms correctly implement the security policy
Subject
User or entity taking the action or accessing a resource such as a database. Always active. May change roles
Object
Item or resource being acted upon by a subject. Always passive. May change roles.
Finger scan technology
Only the features extracted from the fingerprint are stored
Fingerprint technology
Entire fingerprints are stored
False Rejection Rate (FRR)
Type 1 Error. Percentage of time a biometric system rejects a known good user, thus not allowing access
False Acceptance Rate (FAR)
Type II Error. Percentage of time a biometric system falsely identifies as good an unknown user, thus allowing access.
Crossover Error Rate (CER)
CER is where the false rejection rate and false acceptance rate cross over. Lower CER means better biometric authentication system.
Signature Dynamics
Biometric factor of handwriting analysis
Voiceprint
Stored voice in the biometric system
Keystroke Dynamics (aka Keystroke pattern recognition)
Recognizes how an individual types on a keyboard. Measures flight time (time between keystrokes) and dwell (length of time a key is pressed).
Dual Control
Two individuals must work together to gain access. aka Split Knowledge, Separation of Duties.