Exam 3 Flashcards
Identification
Users, assigning a unique identifier to the user
Authentication
Process of associating user/name with other identifier (making sure is legit)
Authorization
Associating user with objects and data they’re allowed to access
Methods for authentication
Something the user should KNOW, HAS, IS
Multi factor-authentication
When more than one unique identifier is required by system to authenticate
Role-based authorization
Role-based access control to restrict network access by assigning individual specific roles that have predefined criteria, for what can/can’t be accessed to.
Roles
Predefined permission users assigned
Permission
Right and privalage user has once assigned to a role
Administration role
Highest role in the hierarchy, has permission for all objects
Principle of least privileged
Users should be assigned only necessary privileges to do their job
Provisioning
process of assigning access to the users
De-provisioning
Process of remaining access when users change jobs or leave organization
Access Creep
Additional roles are assigned to users that are needed temporarily, but not removed
User Access reviews
Compare user job responsibilities with roles assigned
Dormant access review
Compare access logs to user permissions to identify permissions that have not been used, and may need to be removed
Dormant user review
Compare access logs to users, identify users that have not access the systems and may need to be reviewed.
Data Center
Data center is the physical location where servers, networks appliances and other hardware to make core IT infrastructure is stored.
SOC 2 audit
Covers security, availability, processing integrity, or privacy for the cloud provider is required. Used when data center is outsourced.
