Week 11 Flashcards
What are the two management steps in access control?
Authentication and Authorization
Define Authentication in the context of access control.
Verifying identity
Define Authorization in the context of access control.
Granting permissions based on identity
What is a Subject in access control?
The access requester (user or machine)
What is an Object in access control?
The resource being accessed
What role does the Reference Monitor play in access control?
Enforces access policies
List the steps in the access control procedure.
- Access Request
- Authentication
- Authorization
- Access Decision
What is Discretionary Access Control (DAC)?
Users define their own access control rules
Provide an example of Discretionary Access Control.
File permissions in operating systems
What is Mandatory Access Control (MAC)?
A central authority defines strict access rules
Provide an example of Mandatory Access Control.
Military security classification systems
What is Role-Based Access Control (RBAC)?
Access is assigned based on predefined roles
Provide an example of Role-Based Access Control.
Enterprise user permissions
What is Attribute-Based Access Control (ABAC)?
Access is granted based on attributes
Provide an example of Attribute-Based Access Control.
Cloud-based security policies
What is Risk-Based Access Control (RAC)?
Access is decided based on calculated risk levels
What is Federated Identity Management (FIM)?
Authentication and authorization are separated
Who handles Authentication in Federated Identity Management?
Identity Providers (IdPs)
Who handles Authorization in Federated Identity Management?
Service Providers (SPs)
What is a key aspect of the Trust Model in FIM?
Users trust IdPs, but SPs do not trust users directly
What does the UK Online Safety Act 2023 relate to?
Cybersecurity laws and regulations
What does the EU GDPR (2016) define?
Individual rights such as right to be informed, access data, and erasure
What are the Seven Key Steps for Data Protection Impact Assessments (DPIAs)?
- Identify the need for a DPIA
- Describe the processing
- Consider consultation
- Assess necessity and proportionality
- Identify and assess risks
- Implement risk mitigation measures
- Document outcomes
What does the CIA Triad stand for?
- Confidentiality
- Integrity
- Availability
