Flashcards
Risk Management 4
Cards in this deck (29)
- 1What does Access Control deal with?Management and control of the ways entities are granted access to resources
- 2What types of Access does it cover?Logical and Physical
- 3What is the purpose of Access Control?To ensure that the proper identity verification is made when an individual attempts to access a security sensitive building, computer systems, or data
- 4What 3 support elements are needed for an enterprise-wide access control facility?- Resource management
- Privilege management
- Policy management - 5What does Resource Management do?Defines rules for an Access Controlled Resource
- 6What do Resource Management rules include?Credential requirements and what user attributes, resource attributes, and environmental conditions are required for access of a given resource for a given function
- 7What does Privilege Management do?Establishes privilege attributes that comprise an individuals access profile
- 8What do Privilege attributes represent?Features of an individual that can be used as the basis for determining access decisions to both physical and logical resources
- 9What does Policy Management do?Governs what is allowable and unallowable in an access transaction
- 10What does NISTIR defines Access Control as?Process of granting or denying specific requests to:
- Obtain and use information and related information processing services
- Enter specific physical facilities - 11What are the 4 types of Access Control Policy?- Discretionary access control (DAC)
- Mandatory access control (MAC)
- Role-based access control (RBAC)
- Attribute-based access control (ABAC) - 12What is Discretionary Access Control?Controls access based on the identity of the requestor and on access rules stating what requestors are (or are not) allowed to do
- 13What is Mandatory access control (MAC)?Controls access based on comparing security labels with security clearances
- 14What is Role-based access control (RBAC)?Controls access based on the roles that users have within the system and on rules stating what accesses are allowed to users in given roles
- 15What is Attribute-based access control (ABAC)?Controls access based on attributes of the user, the resource to be accessed, and current environmental conditions
- 16What is a Subject also known as?A User
- 17What is a Subject (User)?An entity capable of accessing objects
- 18What are the 3 classes of Subject?- Owner
- Group
- World - 19What is an Object also known as?A Document
- 20What is an Object?Entity used to contain and/or receive information
- 21Are Objects Access Controlled?Yes
- 22What do Access Rights describe?The ways in which a subject may access an object
- 23What could Access Rights include?Read
Write
Execute
Delete
Create
Search - 24What is DAC?Discretionary Access Control
- 25What is Discretionary Access Control?Scheme in which an entity may be granted access rights that permit the entity, by its own volition, to enable another entity to access some resource.
- 26How is it often provided/shown?Using an Access Matrix
- 27What do the 2 dimensions of an Access Matrix show?- One dimension consists of identified subjects that may attempt data access to the resources
- The other dimension lists the objects that may be accessed - 28What does each entry in the matrix indicate?The access rights of a particular subject for a particular object
- 29Pic of the Diagram
Information
- Description
- Risk Management and Cyber Security Flashcards on Risk Management 4, created by Emma McInally on 13/02/2020.
- Created by
- Emma McInally
- Views
- 0
- Rating