ISC2 - Study Notes 6

Question 1

Administrators create rules that determine access to resources. As an example, routers have rules within an ACL. These rules identify what traffic the router will pass based on IP addresses, ports, and protocols.

Answer 1

Rule-based Access Control

Question 2

is a more sophisticated type of Rule-based Access Control. It evaluates subject and object attributes, and grants access based on the value of these attributes. Attributes can be almost any characteristic of a user, the environment, or the resource.

Answer 2

Attribute-based Access Control (ABAC)

Question 3

Both the Clark-Wilson model and the Brewer-Nash model can be used to enforce the principle of separation of duties. The Brewer-Nash model also helps prevent a conflict of interest.

Answer 3

Info

Question 4

is a list of objects along with the permissions granted for each object. You can think of an ??? as a group of ACLs. Each ACL represents a single object and lists all the permissions for that object.

Answer 4

Access Control Matrix

Question 5

is a list of subjects, along with the capabilities granted to the subjects. These capabilities include rights and permissions. For example, a ??? can list several groups such as Project Managers, Project Team Leads, and Project Members. It then lists the rights and permissions granted to each of these groups.

Answer 5

capability table

Question 6

refers to granting accounts access to resources. Accounts need to be configured properly when they are first created, managed while in use, and disabled or deleted when they are no longer needed.

Answer 6

Identity and access management (IAM)

Question 7

??? include both rights and permissions. Rights are actions that an account can take on a system, such as backing up files, changing the time, or rebooting the computer. Permissions identify what a user can do with resources, such as reading and writing to a file or printing to a printer.

Answer 7

Privileges

Question 8

It’s important to verify a person’s identity before creating a user account. Within an organization, Human Resources (HR) departments typically have processes they use for identity verification. Many HR departments require documents such as a driver’s license.

Answer 8

Identity Proofing

Question 9

refers to creating accounts for users and granting them access to appropriate resources.

Answer 9

Provisioning

Question 10

??? protect against online brute-force attacks where the attacker attempts to guess the password. They are not effective against offline password attacks where the attacker has obtained a database of encrypted passwords and attempts to discover the actual passwords from the database.

??? This identifies how many incorrect passwords are allowed.

??? This identifies how long the account remains locked out.

Answer 10

Account lockout policies / Threshold / Duration