Security Controls Flashcards
Auditing (security controls)
One time evaluation
vs monitoring which is on going
Bollards
Vehicle barricades usually outside of government buildings
Duress based alarm
Alarm that’s set off by a person when there is some kind of emergency
Proximity alarms
RFID to tell when something moves
Like tagged clothing at a retail store
Magnetometer
Metal detectors
5 types of door locks
Key
Mechanical (cipher lock) like at fast food
Electronic
Badge reader
Biometric
Biometric scanner intrusiveness order
Least to most
Facial id
Fingerprint
Palm reader
Retina scan
Access control vestibule
Metro turnstile access type thing
Can be a full cage also
(Prevent tailgating and piggybacking)
3 types of badge readers
Magnet strip (old)
Smart card (new) like a credit card
RFID (new)
3 types of equipment locks
(Not including Kensington locks)
Lockable rack cabinet
Chassis locks
Faceplate
Least privilege principle
Things and people should always use as little permission possible
Three role based access types
DAC (discretionary access control)
MAC (mandatory access control)
RBAC (role based access control)
Discretionary access control
(DAC)
Each owner decides rights and permissions
Mandatory access control
(MAC)
The computer system decides who gets access (military style)
-Unclassified
-Confidential
-Secret
-Top secret
Also uses “need to know”
Role-Based Access Control
(RBAC)
Group based permissions like in a domain
(Considered best practice)
Power users
Between a normal user and a admin
Zero-trust framework
(4 parts)
reexamine default access controls
employ a variety of prevention techniques
Enable real time monitoring
Ensure zero trust aligns with security strategy
Identification
Is provided by the user
Examples:
Usernames
Account number
Social security number
Authentication
Validates identity
Multi factor authentication 5 types
MFA
Knowledge - something you know
Ownership - something you have
Characteristic - something you are
Location - somewhere you are
Action - something you do
TOTP
Time-based One Time Password
HOTP
HMAC-based one time password
Hash based one time password
In-band authentication
Uses the same device to do both authentications
Password on your phone and email on your phone
Out of band authentication
OOB
Uses separate communication to send the OTP or PIN
EMM
Enterprise mobility management
Management of corporate mobile devices
the policy’s and the tools
MDM
mobile device management
The tools that control the devices
6 MDM features
Application control
Passwords
MFA requirements
Token based access
Patch management
Remote wipe
OU (Active Directory)
Oganizational unit
Login scripts
On login:
Use to map network drives, permissions, open programs, and folder redirection
