Access Controls

Question 1

Access Control

Answer 1

Access control → security mechanism that determines who can access a resource, what actions they are allowed to perform, and under what conditions access is permitted or denied.

Question 2

Least Privilege

Answer 2

Least privilege → access control principle that ensures users are granted only the minimum permissions necessary to perform their job functions, reducing the impact of compromised accounts.

Question 3

MAC in Linux

Answer 3

Mandatory access control (MAC) → access control model where permissions are enforced by the system based on security policies and classifications, not by the resource owner, commonly used in high-security environments.

Question 4

DAC in Linux

Answer 4

Discretionary access control (DAC) → access control model where the owner of a resource decides who can access it, offering flexibility but increasing the risk of improper permission settings.

Question 5

RBAC

Answer 5

Role-based access control (RBAC) → access control model that assigns permissions based on job roles, making access management scalable and consistent across an organization.

Question 6

Rule Based Access Control

Answer 6

Rule-based access control → access control model that grants or denies access based on predefined rules such as Internet Protocol address, device type, or network conditions.

Question 7

ABAC

Answer 7

Attribute-based access control (ABAC) → access control model that makes dynamic decisions using multiple attributes such as user identity, device posture, location, time, and resource sensitivity.

Like: Allow nurses to read patient records only if they are assigned to the patients ward, and at specific times, etc.

Question 8

Time of Day Restrictions

Answer 8

Time of day restrictions → access control technique that limits system access to specific hours, reducing exposure to unauthorized access during off-hours.

Question 9

MFA

Answer 9

Multifactor authentication (MFA) → authentication method requiring two or more factor types such as something you know like a username and password, something you have like a smartphone or hardware token, something you are like a fingerprint or facial scan, or somewhere you are based on geographic location.

Question 10

Just-in-time Permission

Answer 10

Just-in-time permission → access control approach that provides temporary elevated access only when needed and automatically removes it after a short time to reduce standing privileges.