CC · Domain 3
Access Controls Concepts
About 22% of the exam
Subjects, objects and rules
- Subject
- the user or process requesting
- Object
- the file or resource wanted
- Rule
- what the subject may do
- Privileged account
- rights beyond a normal user
- Default posture
- deny unless explicitly allowed
- Access control matrix
- subjects against objects grid
Physical access controls
- Badge readers log every entry
- Access control vestibule stops tailgating
- Turnstiles admit one person only
- Fences delay and lighting deters
- Bollards keep vehicles away
- Locked racks inside locked rooms
- Layout guides movement naturally
- Escort visitors at all times
Watching the perimeter
- Security guard
- judgment and unplanned response
- Camera
- records for later review
- Alarm
- raises attention immediately
- Motion sensor
- detects movement in a zone
- Entry log
- who entered and when
- Two-person rule
- nobody alone in sensitive rooms
Authorized and unauthorized people
- Badges show authorization at a glance
- Challenge anyone without a badge
- Visitors sign in and out
- Contractors get time-limited access
- Report a lost badge immediately
- Deactivate the badge, not merely collect it
Logical access control models
Discretionary
- The owner decides who gets access
- Access control lists on files
- Flexible, but sprawls quickly
- Default on common file systems
Mandatory
- The system enforces labels and clearance
- Users cannot share at will
- Clearance plus need to know
- Used where classification matters
Role and attribute
- Role based ties rights to jobs
- Change the role, not the person
- Attribute based weighs context too
- Time of day and device state
- Rule based applies if-then logic
Ask who decides: the owner is discretionary, the system by label is mandatory, the job is role based, the context is attribute based
Proving who you are
Factors
- Know: password or PIN
- Have: token, card or phone
- Are: fingerprint, face or iris
- Two of the same is one factor
Biometric errors
- False rejection annoys valid users
- False acceptance is the security failure
- Crossover error rate compares devices
- A lower crossover rate is better
- Enrollment captures the reference template
Stronger choices
- A security key resists phishing
- Authenticator app beats SMS codes
- Number matching stops prompt bombing
- Passwordless uses device held keys
Least privilege and its family
- Grant only what the job needs
- Need to know narrows it further
- Segregation of duties splits critical tasks
- Privilege creep follows internal moves
- Review and recertify access regularly
- Remove rights when the role changes
Account lifecycle
- Request and approval
- Provision with a role
- Use and monitor
- Review and recertify
- Modify on transfer
- Disable on exit
- Disable first, delete after retention
- Deprovisioning starts the same day
- Orphan accounts have no living owner
- Automate provisioning from the HR record
Account types
- User account
- one named human
- Privileged account
- administrator level rights
- Service account
- runs software, no human
- Shared account
- avoid, it destroys accountability
- Guest account
- limited, usually disabled
- Emergency account
- sealed, monitored, rarely used
Password practice
- Length matters more than symbols
- Never reuse a work password
- Use a password manager
- Change it when compromise is suspected
- Lockout after repeated failed attempts
- History stops recycling old passwords
- Never share it or write it down
Single sign-on and federation
- Single sign-on
- one login, many applications
- Federation
- trusting another organization identity
- Identity provider
- authenticates and vouches
- Service provider
- accepts the assertion
- SAML
- assertions for enterprise sign-on
- OAuth
- delegated access for an application
- The risk
- one credential opens everything
How access goes wrong
- Tailgating
- slipping in behind someone
- Piggybacking
- let through with their consent
- Shoulder surfing
- reading over your shoulder
- Dumpster diving
- useful data from the bins
- Stale account
- a leaver who can still log in
- Excess privilege
- rights the job never needed
- Shared credential
- nobody can be held accountable
Rapid recall
- Subject
- who is asking
- Object
- what is wanted
- DAC
- the owner decides
- MAC
- the system decides by label
- RBAC
- the job role decides
- ABAC
- attributes and context decide
- FRR
- valid user wrongly refused
- FAR
- wrong user wrongly admitted
- CER
- where the two rates meet
Know the numbers
- Factor categories
- know, have, are
- Multi-factor
- two different categories, minimum
- Crossover error rate
- lower means a better device
- Lockout
- small threshold, timed release
- Access review
- more often for privileged accounts
- Leavers
- disable now, delete later
Reference strip: physical, logical, identity, failure
Physical
- Badges, turnstiles, vestibules, guards
- Fencing, lighting, bollards, locks
- Cameras, alarms, motion sensors
- Visitor escort and sign in
Logical models
- Discretionary, mandatory, role based
- Attribute based and rule based
- Implicit deny as the default
- Access control matrix and lists
Identity
- Identification, authentication, authorization, accounting
- Factors and multi-factor combinations
- Biometrics, FRR, FAR, CER
- Single sign-on and federation
Principles
- Least privilege and need to know
- Segregation of duties, two-person rule
- Access review and recertification
- Joiner, mover, leaver handling
Failures
- Tailgating and piggybacking
- Shoulder surfing and dumpster diving
- Orphan and shared accounts
- Privilege creep after transfers
Quick exam traps
- Trap: In discretionary access control the administrator owns the data
- Trap: A clearance alone entitles someone to the document
- Trap: False rejection is the more dangerous biometric error
- Trap: Collecting the badge is enough when someone leaves
- Trap: Single sign-on removes the single point of failure
- Trap: A shared team account is fine if the password is strong
- Trap: Role based access control removes excess rights automatically
cybercertprep.com · original revision sheet written from the public body of knowledge