Access Control 4.6

Question 1

Access Control

Answer 1

• All security features used to prevent unauthorized access to a computer system or network.

Question 2

Authorization

Answer 2

• The process of ensuring only authorized right are exercised
• Process of determining rights
• Policy definition

Question 3

Least Privilege

Answer 3

• Rights and permission should be set to the bare minimum, only what’s needed to complete the objective

Question 4

Using Least Privilege to Limit Malicious Behavior

Answer 4

• Don’t allow the user with Admin privileges.

Question 5

Mandatory Access Control (MAC)

Answer 5

• OS limits the operation on an object, based on security clearance levels.

Question 6

MAC Labels

Answer 6

• Every object, or file, gets label.
• Labels can include “Confidential”, “Secret”, “Top Secret”

Question 7

MAC Labels Predefined Rules

Answer 7

• Labeling of objects uses predefined rules which is decided by the administrator.
• Admin decides who gets access to what security level.
• Users cannot change these settings

Question 8

Discretionary Access Control (DAC)

Answer 8

• Most common type of access control
• the owner can decide which subjects can have access to the object and the specific access.
• Flexible access control, weak security

Question 9

Role-Based Access Control (RBAC)

Answer 9

• Based on the subject’s role within the organization
• The admin provides access based on the user’s role and grants specific rights and permissions

Question 10

Rule-Based Access Control

Answer 10

• Access is determined through system-enforced rules by the system admin, not the user.
• The system will check the ACLs for the object, and check if that object matches the set of rules.