4.3 Implement identity and access management controls

Question 1

Access control models

Answer 1

Select an appropriate model from DAC, RBAC, ABAC, and MAC based on the security requirement and available resources.

A model like MAC, RBAC, or ABAC needs support in the underlying OS and applications software to implement, so identify how provisioning this software will affect the decision.

Identify user account types to implement within the model, such as standard users and types of privileged users.

Identify what service accounts will be needed and how they will be secured against misuse.

Identify group or role account types and how users will be allocated to them.

Ideally, eliminate any dependency on shared and generic account types.

Question 2

MAC

Answer 2

(mandatory access control) An access control model where resources are protected by inflexible, system defined rules. Resources (objects) and users (subjects) are allocated a clearance level (or label).

Question 3

DAC

Answer 3

(discretionary access control) Access control model where each resource is protected by an Access Control List (ACL) managed by the resource’s owner (or owners).

Question 4

ABAC

Answer 4

(attribute-based access control) An access control technique that evaluates a set of attributes that each subject possesses to determine if access should be granted.

Question 5

Role-based access control

Answer 5

A set of organizational roles are defined, and users allocated to those roles. Under this system, the right to modify roles is reserved to administrative accounts.

Question 6

Rule-based access control

Answer 6

Refer to any sort of access control model where access control policies are determined by system-enforced rules rather than system users.

Question 7

Proximity cards

Answer 7

A contactless smart card that can transfer data using a tiny antenna embedded in the card.

Question 8

Smart cards

Answer 8

A credit card-sized device with an integrated chip and data interface.

Question 9

False acceptance rate

Answer 9

False positives or Type II error

Question 10

False rejection rate

Answer 10

False negatives or Type I error

Question 11

Crossover error rate

Answer 11

The point at which false rejection rate and false acceptance rate meet. The lower the CER, the more efficient and reliable the technology.

Question 12

HOTP/TOTP

Answer 12

(HMAC-based One-time Password) An algorithm that generates a one-time password using a hash-based authentication code to verify the authenticity of the message.

Question 13

PIV/CAC/smart card

Answer 13

(Personal Identity Verification card) A smart card that meets the standards for FIPS 201, in that it is resistant to tampering and provides quick electronic authentication of the card’s owner.

Question 14

IEEE 802.1x

Answer 14

Port-based network access control framework works with smart cards and other token based systems.