Week 10-11 Flashcards
(18 cards)
is a security technique that regulates who or
what can view or use resources.
Access Control
4 Core components
Identification
Authentication
Authorization
Accountability
Declaring identity (e.g., username, ID card)
Identification
Proving identity (e.g., password, biometrics)
Authentication
Determining what the user is allowed to do
Authorization
Tracking user actions for auditing
Accountability
define how access rights are assigned and enforced.
Access models
Access control models 4 main types:
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC)
Attribute-Based Access Control (ABAC)
Is a permission system where the owner of the data (usually the person who created it) decides who can access it and what they can do with it (read, write, delete, etc.).
Discretionary Access Control (DAC)
is a strict access control system where access to data is based on security policies and classification levels, not user preferences. The system enforces the rules, and users cannot change them.
Mandatory Access Control (MAC)
is a method of managing access where permissions are assigned based on a user’s role in an organization.
Instead of assigning permissions to each user individually, you assign them to roles, and then assign users to those roles.
Role-Based Access Control (RBAC)
is a flexible and dynamic access control model where access decisions are made
based on multiple attributes
Attribute-Based Access Control (ABAC)
the tools and components that enforce the rules and models (like DAC, MAC, RBAC, ABAC) we use to manage who can access what in a system.
Access Control Mechanisms
is attached to a resource (like a file or folder) and lists which users or groups are allowed to do specific actions (read, write, execute, delete).
Access Control Lists
is tied to a user or process and shows what resources they are allowed to access and with what
permissions.
Capability List
is the part of a system that physically enforces access control. It intercepts requests and either blocks or
forwards them for a decision.
Policy Enforcement Point (PEP)
is the component that makes the decision based on the policies: “Should access be allowed or not?”
It works behind the scenes, often in coordination with the PEP.
Policy Decision Point (PDP)
is the science of protecting information by converting it into an unreadable format, so that only
authorized parties can understand it when it’s decrypted.
Cryptography
