Fundamentals of Security Flashcards
Objectives 1.1 and 1.2 (104 cards)
1
Q
Define / Explain
Information Security
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
Protecting data and information from unauthorized access, modification, disruption, disclosure, and destruction
2
Q
Define / Explain
Information Systems Security
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
Protecting the systems (e.g., computers, servers, network devices) that hold and process critical data
3
Q
Define / Explain
Confidentiality
CIA Triad
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
Ensures information is acessible only to authorized personnel (e.g., encryption)
CIA Triad - Confidentiality
4
Q
Define / Explain
Integrity
CIA Triad
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
Ensures data remains accurate and unaltered (e.g., checksums)
CIA Triad - Integrity
5
Q
Define / Explain
Availability
CIA Triad
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
Ensures information and resources are accessible when needed (e.g., redundancy measures)
CIA Triad - Availability
6
Q
Define / Explain
CIANA Pentagon
CIA Triad + NA = CIANA Pentagon
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
An extension of the CIA triad with the addition of non-repudiation and authentication
CIANA Pentagon = Non-repudiation + Authentication
7
Q
Define / Explain
Non-Repudiation
CIA Triad + NA = CIANA Pentagon
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
Guarantees that an action or event cannot be denied by the involved parties (e.g., digital signatures)
CIANA Pentagon - Non-repudiation
8
Q
Define / Explain
Authentication
AAA / Triple A’s of Security & CIANA Pentagon
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
Verifying the identity of a user or system (e.g., password checks)
AAA / Triple A’s of Security & CIANA Pentagon - Authentication
9
Q
Define / Explain
Authorization
AAA / Triple A’s of Security
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
Determining actions or resources an authenticated user can access (e.g., permissions)
AAA / Triple A’s of Security
10
Q
Define / Explain
Accounting
AAA / Triple A’s of Security
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
Tracking user activities and resource usage for audit or billing purposes
AAA / Triple A’s of Security
11
Q
List the following
Security Control Categories
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
- Technical
- Managerial
- Operational
- Physical
Security Control Categories (4)
12
Q
List the following
Security Control Types
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
- Preventative
- Deterrent
- Detective
- Corrective
- Compensating
- Directive
Security Control Types (5)
13
Q
Define / Explain
Zero Trust Model
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
Operates on the principle that no one should be trusted by default
14
Q
Informational
Zero Trust Model
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
To achieve zero trust, we use the control plane and the data plane
Informational
15
Q
Define / Explain
Control Plane
Zero Trust Model
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
Adaptive identity, threat scope reduction, policy-driven access control, and secured zones
16
Q
Define / Explain
Data Plane
Zero Trust Model
Obj. 1.0 - General Security Concepts | Fundamentals of Security
A
Subject/system, policy engine, policy administrator, and establishing policy enforcement points
17
Q
Define / Explain
Threat
Obj. 1.0 - General Security Concepts | Threats & Vulnerabilities
A
Anything that could cause harm, loss, damage, or compromise to our information technology systems
18
Q
Informational
Threats can come from the following…
Obj. 1.0 - General Security Concepts | Threats & Vulnerabilities
A
- Natural disasters
- Cyber-attacks
- Data integrity breaches
- Disclosure of confidential information
Informational
19
Q
Define / Explain
Vulnerability
Obj. 1.0 - General Security Concepts | Threats & Vulnerabilities
A
Any weakness in the system design or implementation
20
Q
Informational
Vulnerabilities can come from internal factors like the following…
Obj. 1.0 - General Security Concepts | Threats & Vulnerabilities
A
- Software bugs
- Misconfigured software
- Improperly protected network devices
- Missing security patches
- Lack of physical security
Informational
21
Q
Informational
Where threats and vulnerabilities intersect, that is where the risk to your enterprise systems and networks lies
Obj. 1.0 - General Security Concepts | Threats & Vulnerabilities
A
- If you have a threat, but there is no matching vulnerability to it, t hen you have no risk
- The same holds true that if you have a vulnerability but there’s no threat against it, there would be no risk
Informational
22
Q
Define / Explain
Risk Management
Obj. 1.0 - General Security Concepts | Threats & Vulnerabilities
A
Finding different ways to minimize the likelihood of an outcome and achieve the desired outcome
23
Q
Informational
Confidentiality…
Obj. 1.2 - Summarize fundamental security concepts | Confidentiality
A
- Refers to the protection of information from unauthorized access and disclosure
- Ensure that private or sensitive information is not available or disclosed to unauthorized individuals, entities, or processes
Informational
24
Q
Informational
Confidentiality is important for three main reasons…
Obj. 1.2 - Summarize fundamental security concepts | Confidentiality
A
- To protect personal privacy
- To maintain a business advantage
- To achieve regulatory compliance
Informational
25
# Define / Explain
Encryption
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Confidentiality
Process of converting data into a code to prevent unauthorized access
## Footnote
(5) Basic methods of confidentiality
26
# Define / Explain
Access Controls
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Confidentiality
By setting up strong user permissions, you ensure that only authorized personnel can access certain types of data
## Footnote
(5) Basic methods of confidentiality
27
# Define / Explain
Data Masking
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Confidentiality
Method that involves obscuring specific data within a database to make it inaccessible for unauthorized users while retaining the real data's authenticity and use for authorized users
## Footnote
(5) Basic methods of confidentiality
28
# Define / Explain
Physical Security Measures
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Confidentiality
Ensure confidentiality for both physical types of data, such as paper records stored in a filing cabinet, and for digital information contained on servers and workstations
## Footnote
(5) Basic methods of confidentiality
29
# Define / Explain
Training & Awareness
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Confidentiality
Conduct regular training on the security awareness best practices that employees can use to protect their organization's sensitive data
## Footnote
(5) Basic methods of confidentiality
30
# *Informational*
Integrity...
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Integrity
* Helps ensure that information and data remain accurate and unchanged from its original state unless intentionally modified by an authorized individual
* Verifies the accuracy and trustworthiness of data over the entire lifecycle
## Footnote
*Informational*
31
# *Informational*
Integrity is important for three main reasons...
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Integrity
* To ensure data accuracy
* To maintain trust
* To ensure system operability
## Footnote
*Informational*
32
# *Informational*
To help us maintain the integrity of our data, systems, and networks, we usually utilize five methods
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Integrity
* Hashing
* Digital Signatures
* Checksums
* Access Controls
* Regular Audits
## Footnote
*Informational*
33
# Define / Explain
Hashing
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Integrity
Process of converting data into a fixed-size value
## Footnote
(5) Methods of integrity
34
# Define / Explain
Digital Signatures
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Integrity
Ensures both integrity and authenticity
## Footnote
(5) Methods of integrity
35
# Define / Explain
Checksums
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Integrity
Method to verify the integrity of data during transmission
## Footnote
(5) Methods of integrity
36
# Define / Explain
Access Controls
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Integrity
Ensure that only authorized individuals can modify data and this reduces the risk of unintentional or malicious alterations
## Footnote
(5) Methods of integrity
37
# Define / Explain
Regular Audits
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Integrity
Involve systematically reviewing logs and operations to ensure that only authorized changes have been made, and any discrepancies are immediately addressed
## Footnote
(5) Methods of integrity
38
# Define / Explain
Availability
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Availability
Ensures that information, systems, and resources are accessible and operational when needed by authorized users
39
# *Informational*
As cybersecurity professionals, we value availability since it can help us with the following...
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Availability
* Ensuring Business Continuity
* Maintaining Customer Trust
* Upholding an Organization's Repudiation
## Footnote
*Informational*
40
# *Informational, both sides*
To overcome the challenges associated with maintaining availability, the best strategy is to use redundancy in your systems and network designs
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Availability
To overcome the challenges associated with maintaining availability, the best strategy is to use redundancy in your systems and network designs
## Footnote
*Informational, both sides*
41
# Define / Explain
Redundancy
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Availability
Duplication of critical components or functions of a system with the intention of enhancing its reliability
42
# *Informational*
There are various types of redundancy you need to consider when designing your systems and networks...
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Availability
* Server Redundancy
* Data Redundancy
* Network Redundancy
* Power Redundancy
## Footnote
*Informational*
43
# Define / Explain
Server Redundancy
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Availability
Involves using multiple servers in a load balanced or failover configuration so that if one is overloaded or fails, the other servers can take over the load to continue supporting your end users
44
# Define / Explain
Data Redundancy
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Availability
Involves storing data in multiple places
45
# Define / Explain
Network Redundancy
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Availability
Ensures that if one network path fails, the data can travel through another route
46
# Define / Explain
Power Redundancy
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Availability
Involes using backup power sources, like generators and UPS systems
## Footnote
UPS = Uninterruptable Power Supply
47
# *Informational*
Non-repudiation
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Non-repudiation
* Focused on providing undeniable proof in the world of digital transactions
* Security measure that ensures individuals or entities involved in a communication or transaction cannot deny their participation or the authenticity of their actions
## Footnote
*Informational*
48
# *Informational*
Digital Signatures
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Non-repudiation
* Considered to be unique to each user who is operating within the digital domain
* Created by first hashing a particular message or communication that you want to digitally sign, and then it encrypts that hash digest with the user's private key using asymmetric encryption
## Footnote
*Informational*
49
# *Informational*
Non-repudiation is important for three main reasons...
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Non-repudiation
* To confirm the authenticity of digital transactions
* To ensure the integrity of critical communications
* To provide accountability in digital processes
## Footnote
*Informational*
50
# Define / Explain
Authentication
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Authentication
Security measure that ensures invidivuals or entities are who they claim to be during a communication or transaction
51
# *Informational*
Five commonly used authentication methods are...
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Authentication
* Something you know (Knowledge Factor)
* Something you have (Possession Factor)
* Something you are (Inherence Factor)
* Something you do (Action Factor)
* Somewhere you are (Location Factor)
## Footnote
*Informational*
52
# Define / Explain
Something you know
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Authentication
Relies on information that a user can recall
| Knowledge Factor
## Footnote
(5) commonly used authentication methods
53
# Define / Explain
Something you have
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Authentication
Relies on the user presenting a physical item to authenticate themselves
| Possession Factor
## Footnote
(5) commonly used authentication methods
54
# Define / Explain
Something you are
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Authentication
Relies on the user providing a unique physical or behavioral characteristic of the person to validate that they are who they claim to be
| Inherence Factor
## Footnote
(5) commonly used authentication methods
55
# Define / Explain
Something you do
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Authentication
Relies on the user conducting a unique action to prove who they are
| Action Factor
## Footnote
(5) commonly used authentication methods
56
# Define / Explain
Somewhere you are
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Authentication
Relies on the user being in a certain geographic location before access is granted
| Location Factor
## Footnote
(5) commonly used authentication methods
57
# Define / Explain
Multifactor Authentication System
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Authentication
Security process that requires users to provide multiple methods of identification to verify their identity
## Footnote
MFA = Multifactor Authentication
58
# *Informational*
Authenticaiton is critical to understand because of the following...
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Authentication
* To prevent unauthorized access
* To protect user data and privacy
* To ensure that resources are accessed by valid users only
## Footnote
*Informational*
59
# Define / Explain
Authorization
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Authorization
Pertains to the permissions and privileges granted to users or entities after they have been authenticated
60
# *Informational*
Authorization mechanisms are important to help us with the following...
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Authorization
* To protect sensitive data
* To maintain the system integrity in our organizations
* To create a more streamlined user experience
## Footnote
*Informational*
61
# Define / Explain
Accounting
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Accounting
Security measure that ensures all user activities during a communication or transaction are properly tracked and recorded
62
# *Informational*
Your organization should use a robust accounting system so that you can create the following...
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Accounting
* Create an audit trail
* Maintain regulatory compliance
* Conduct forensic analysis
* Perform resource optimization
* Achieve user accountability
## Footnote
*Informational*
63
# Define / Explain
Create an audit trail
| Accounting System
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Accounting
Provides a chronological record of all user activities that can be used to trace changes, unauthorized access, or anomalies back to a source or point in time
64
# Define / Explain
Maintain regulatory compliance
| Accounting System
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Accounting
Maintains a comprehensive record of all users' activities
65
# Define / Explain
Conduct forensic analysis
| Accounting System
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Accounting
Uses detailed accounting and event logs that can help cybersecurity experts understand what happened, how it happened, and how to prevent similar incidents from occurring again
66
# Define / Explain
Perform resource optimization
| Accounting System
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Accounting
Organizations can optimize system performance and minimize costs by tracking resource utilization and allocation decisions
67
# Define / Explain
Achieve user accountability
| Accounting System
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Accounting
Thorough accounting system ensures users' actions are monitored and logged, deterring potential misuse and promoting adherence to the organization's policies
68
# *Informational*
To perform accounting, we usually use different technologies like the following...
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Accounting
* Syslog Servers
* Network Analysis Tools
* SIEM Systems
| SIEM = Security Information and Event Management
## Footnote
*Informational*
69
# Define / Explain
Syslog Servers
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Accounting
Used to aggregate logs from various network devices and systems so that system administrators can analyze them to detect patterns or anomalies in the organization's systems
## Footnote
Example: Kiwi Syslog Server NG by SolarWinds
70
# Define / Explain
Network Analysis Tools
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Accounting
Used to capture and analyze network traffic so that network administrators can gain detailed insights into all the data moving within a network
## Footnote
Example: Wireshark
71
# Define / Explain
SIEM Systems
| SIEM = Security Information and Event Management
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Accounting
Provides us with real-time analysis of security alerts generated by various hardware and software infrastructure in an organization
## Footnote
Example: Splunk
72
# *Informational*
(4) Broad Categories of Security Controls
## Footnote
Obj. 1.1 - Summarize fundamental security concepts | Security Control Categories
* Technical Controls
* Managerial Controls
* Operational Controls
* Physical Controls
## Footnote
*Informational*
73
# Define / Explain
Technical Controls
| (4) Broad Categories of Security Controls
## Footnote
Obj. 1.1 - Summarize fundamental security concepts | Security Control Categories
Technologies, hardware, and software mechanisms that are implemented to manage and reduce risks
74
# Define / Explain
Managerial Controls
| (4) Broad Categories of Security Controls
## Footnote
Obj. 1.1 - Summarize fundamental security concepts | Security Control Categories
* Sometimes also referred to as administrative controls
* Involves the strategic planning and governance side of security
75
# Define / Explain
Operational Controls
| (4) Broad Categories of Security Controls
## Footnote
Obj. 1.1 - Summarize fundamental security concepts | Security Control Categories
* Procedures and measures that are designed to protect data on a day-to-day basis
* Are mainly governed by internal processes and human actions
76
# Define / Explain
Physical Controls
| (4) Broad Categories of Security Controls
## Footnote
Obj. 1.1 - Summarize fundamental security concepts | Security Control Categories
Tangible, real-world measures taken to protect assets
77
# *Informational*
(6) Basic Types of Security Controls
## Footnote
Obj. 1.1 - Summarize fundamental security concepts | Security Control Types
* Preventic Controls
* Deterrent Controls
* Detective Controls
* Corrective Controls
* Compensating Controls
* Directive Controls
## Footnote
*Informational*
78
# Define / Explain
Preventive Controls
| (6) Basic Types of Security Controls
## Footnote
Obj. 1.1 - Summarize fundamental security concepts | Security Control Types
Proactive measures implemented to thwart potential security threats or breaches
79
# Define / Explain
Deterrent Controls
| (6) Basic Types of Security Controls
## Footnote
Obj. 1.1 - Summarize fundamental security concepts | Security Control Types
Discourage potential attackers by making the effort seem less appealing or more challenging
80
# Define / Explain
Detective Controls
| (6) Basic Types of Security Controls
## Footnote
Obj. 1.1 - Summarize fundamental security concepts | Security Control Types
Monitor and alert organizations to malicious activities as they occur or shortly thereafter
81
# Define / Explain
Corrective Controls
| (6) Basic Types of Security Controls
## Footnote
Obj. 1.1 - Summarize fundamental security concepts | Security Control Types
Mitigate any potential damage and restore our systems to their normal state
82
# Define / Explain
Compensating Controls
| (6) Basic Types of Security Controls
## Footnote
Obj. 1.1 - Summarize fundamental security concepts | Security Control Types
Alternative measures that are implemented when primary security controls are not feasible or effective
83
# Define / Explain
Directive Controls
| (6) Basic Types of Security Controls
## Footnote
Obj. 1.1 - Summarize fundamental security concepts | Security Control Types
* Guide, inform, or mandate actions
* Often rooted in policy or documentation and set the standards for behavior within an organization
84
# Define / Explain
Gap Analysis
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Gap Analysis
Process of evaluating the differences between an organization's current performance and its desired performance
85
# *Informational, both sides*
Conducting a gap analysis can be a valuable tool for organizations looking to improve their operations, processes, performance, or overall security posture
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Gap Analysis
Conducting a gap analysis can be a valuable tool for organizations looking to improve their operations, processes, performance, or overall security posture
## Footnote
*Informational, both sides*
86
# *Informational*
There are several steps involved in conducting a gap analysis...
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Gap Analysis
* Define the scope of the analysis
* Gather data on the current state of the organization
* Analyze the data to identify any areas where the organization's current performance falls short of its desired performance
* Develop a plan to bridge the gap
## Footnote
*Informational*
87
# *Informational*
(2) Basic Types of Gap Analysis
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Gap Analysis
* Technical Gap Analysis
* Business Gap Analysis
## Footnote
*Informational*
87
# Define / Explain
Technical Gap Analysis
| (2) Basic Types of Gap Analysis
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Gap Analysis
* Involves evaluating an organization's current technical infrastructure
* Identifying any areas where it falls short of the technical capabilities required to fully utilize their security solutions
88
# Define / Explain
Business Gap Analysis
| (2) Basic Types of Gap Analysis
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Gap Analysis
* Involves evaluating an organization's current business processes
* Identifying any areas where they fall short of the capabilities required to fully utilize cloud-based solutions
89
# *Informational*
Plan of Action and Milestones (POA&M)
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Gap Analysis
* Outlines the specific measures to address each vulnerability
* Allocate resources
* Set up timelines for each remediation task that is needed
## Footnote
POA&M = Plan of Action & Milestones
90
# *Informational, both sides*
Zero Trust demands verification for every device, user, and transaction within the network, regardless of its origin
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Zero Trust
Zero Trust demands verification for every device, user, and transaction within the network, regardless of its origin
## Footnote
*Informational, both sides*
91
# *Informational*
To create a zero trust architecture, we need to use two different planes
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Zero Trust
* Control Plane
* Data Plane
## Footnote
*Informational*
92
# Define / Explain
Control Plane
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Zero Trust
Refers to the overarching framework and set of components responsible for defining, managing, and enforcing the policies related to user and system access within an organization
93
# *Informational*
Control Plane typically ecompasses several key elements...
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Zero Trust
* Adaptive Identity
* Threat Scope Reduction
* Policy-Driven Access Control
* Secured Zones
## Footnote
*informational*
94
# Define / Explain
Adapative Identity
| Control Plane elements
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Zero Trust
Relies on real-time validation that takes into account the user's behavior, device, location, and more
95
# Define / Explain
Threat Scope Reduction
| Control Plane elements
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Zero Trust
* Limits the users' access to only what they need for their work tasks because this reduces the network's potential attack surface
* Focused on minimizing the "blast radius" that could occur in the event of a breach
96
# Define / Explain
Policy-Driven Access Control
| Control Plane elements
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Zero Trust
Entails developing, managing, and enforcing user access policies based on their roles and responsibilities
97
# Define / Explain
Secured Zones
| Control Plane elements
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Zero Trust
Isolated environments within a network that are designed to house sensitive data
98
# *Informational, both sides*
Control Plane uses a Policy Engine and a Policy Administrator to make decisions about access
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Zero Trust
Control Plane uses a Policy Engine and a Policy Administrator to make decions about access
## Footnote
*Informational, both sides*
99
# Define / Explain
Policy Engine
| Control Plane decisions about access
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Zero Trust
Cross-references the access request with its predefined policies
100
# Define / Explain
Policy Administrator
| Control Plane decisions about access
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Zero Trust
Used to establish and manage the access policies
101
# *Informational*
Data Plane consists of the following...
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Zero Trust
* Subject / System
* Policy Enforcement Point
## Footnote
*Informational*
102
# Define / Explain
Subject / System
| Data Plane definitions
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Zero Trust
Refers to the individual or entity attempting to gain access
103
# Define / Explain
Policy Enforcement Point
| Data Plane definitions
## Footnote
Obj. 1.2 - Summarize fundamental security concepts | Zero Trust
Where the decision to grant or deny access is actually executed
