Exam 3 Flashcards
(71 cards)
Identification
Users assigning a unique identifier to the user
Authentication
Process of associating user/name with other identifier (making sure is legit)
Authorization
Associating user with objects/data they’re allowed to access.
Methods for authentication and multifactor authentication
Something user should KNOW, HAS, and IS
Multifactor authentitication
When more than one unique identifier is required by system, to authenticate
Role-based authorization, why’s it used?
To restrict network access by assigning individual specific roles that have predefined criteria, for what can/can’t be accessed to.
Role
Predefined permission users are assigned
Permission
Right/privilege user has once assigned to a role
Administrator role
Highest role in the hierchary, has premission for all objects
Principle of leas privileged
Users should be assigned only necessary privileges to do their job
Provisioning
Process of assigning access to users
De-Provisioning
Process of removing access when user changes jobs/leaves organizations
Access Creep
Additional roles are assigned to users that are needed temporarily, but not removed
User access reviews
Compare user job responsibilties with a role assigined
dormant access review
Compare access logs to user permissions to identify permissions that have not been used, and may need to be removed
Dormant user review
Compare access logs to users, identify users that have not accessed the system and may need to be removed
Data Center
Physical location where servers, network appliances and other hardware to make core IT infrastructure is stored.
Importance of data center control
Important because it runs all of IT
SOC 2 Audit
Covers security, availability, processing integrity or privacy for the cloud provider is required. Used when data center is outsourced.
Outside environment
Near bottom floors of physical building, building will be on high ground
Inside environment
Own A/C to avoid overheating, non-water fire suppression system presents.
Physical security
only employees involved with operation allowed, single entry point.
Relationship between incident response, disaster recovery, business continuity.
Ensures business and process continue running smoothly.
Data Prioritization
Companies’ categories systems and data based on importance, they do this in case of disaster recovery and business continuity.