Lesson 3

Question 1

access control basics (4)

Answer 1

allowing
denying
limiting
revoking

Question 2

most common permissions in ACLs (3)

Answer 2

read, write, execute

Question 3

network ACLs regulate the activity of

Answer 3

IP addresses, MAC addresses, ports

Question 4

attack that utilizes elevated permissions of software when the user has lower permissions

Answer 4

cross-site request forgery and clickjacking (confused deputy problem)

Question 5

attack that misuses the authority of browser on the user’s computer. embeds a link into a web page or email that will direct the user to the link without their knowledge

Answer 5

CSRF (cross-site request forgery)

Question 6

attack that manipulates a web page and creates a ‘cover’ that users interact with, when they think they are interacting with the normal web page

Answer 6

clickjacking

Question 7

model of access control based on access being determined by the owner of the resource

Answer 7

discretionary

Question 8

model of access control in which access is decided by a group of authority which may or may not include the owner of the resource

Answer 8

mandatory

Question 9

model of access control based off allowing or denying based on a set of predetermined rules

Answer 9

rule-based

Question 10

model of access control that functions on access controls set by a responsible authority, access is based on the role of the individual accessing the data

Answer 10

role-based

Question 11

model of access control based on attributes of a particular person, resource, or environment

Answer 11

attribute-based

Question 12

model that implements DAC and MAC, mainly concerned with confidentiality (no read up and no write down)

Answer 12

bell-lapadula model

Question 13

model concerned with integrity of data (no read down and no write up)

Answer 13

biba model

Question 14

model designed to prevent conflicts of interest (contains objects, company groups, conflict classes), focused on data integrity

Answer 14

brewer and nash model