Domain 1: Access Control Flashcards
Access aggregation security considers are: 1. 2. 3. 4.
- Need for controlled inheritance of all access privileges
- Support for separation of duties
- Need to maintain the principle of least privilege and monitoring to make sure authorization creep doe snot occur as job roles change.
- Need to maintain security of access permissions so that unauthorized individiuals cannot gain access to multiple network resources through single login
Access Aggregation
Combining permissions from a. Single computer or various networked resources so multiple logins not required.
What is Single Sign-On
SSO. Requires user to complete the authentication process only once to access multiple applications.
Advantages of SSO:
- logon process efficient
- eliminates need for writing down mulitiple passwords on paper. Users can use strong PWs.
- System admins can streamline user accoutn management and used centralized control mechanisms
- User authentication time reduced
Disadvantages of SSO:
1 - user granted intiial access to a network can access all organizational resources
2 - if attacker gains access, they can get all resources
3 - difficult to implement because of diverse apps, OS, and networks
Weaknesses of passwords
Easily guessed. Name DOB
broken by programs like crack, SmartPass can decrypt Unix etc PWs
forgotten. Long/ complex. Users write them down
PWs should avoid using:
- common names, DOB, spouse name
- words found easily in dictionary
- system default (hackers know)
- password
Strong PW characteristics
8-10 characters
Alphanumeric and special characters
Lower and upper case letters
Difficult to crack but easy doe user to remember.
System admin controls that can be added to fortify
Set expiry dates for PWs Accept only combo alpha and special PWs Set minimum length Prevent reuse of old PWs Track unsuccessful login attempts Identify weak PWs through auditing and replace.
For access control to be effective an org must have a dedicated _____ who ______.
Designated owner who determines appropriate classification and access controls for the data.
Data Owner Roles and Responsibilities of Data Owner
- Classify data and reiew classification categories and accommodate changing business needs
- Ensue security controls for the classified data
- Review and ensure the owners access rights match the information assets the owner holds
- Determine security and backup requirements and access criteria
- Perform or delegat approval authority for access requests from other orgs
- Delegate bacup and recovery duties
- Approve information disclosure
- Act on security violation notifications
Who is responsible for Performing backup to ensure they meet the backup requirements to restore lost data in case of system failure? They also ensure availability of information and and ensure record retention.
Data custodian
What are the steps to define an effective data management system?
- Define data as the organizations assets
- Delegat local business managers as data owners.
- Delegation formation systems personnel as data custodians
- Define roles and responsibilities
- Determine data classification criteria
- Determine controls for each classification
Different types of attacks used agains passwords and password files (5)
Brute force Dictionary Denial of service Sniffing Spoofing
What type of attack is also known as an exhaustive attack?
Brute force
