WGU C845 VUN1 Task 1,2,& 3| Passed on First Attempt |Latest Update with Complete Solution

VUN1—VUN1Task1:ManagingSecurityOperationsandAccess Controls n7




Information SystemsSecurity- C845 n7 n7




A. ApplyanAccessControlModel n7 n7




A.1. ChosenAccess ControlModel n7 n7 n7




Ihave chosen the Role-Based Access Control (RBAC) model. Theprinciples ofRBAC are:
n7 n 7 n 7 n7 n 7 n 7 n 7 n 7 n 7 n7 n7




• Role Assignment: Auser is assigned to a role based on their job function (e.g., ”Finance
n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7




Analyst”).
n7




• PermissionAssignment:Permissionstoperformoperationsonsystemsareassignedtoroles,
n7 n7 n7 n7 n7 n7 n7




not to individual users.
n7 n7 n7 n7




• SessionManagement: A useractivatesaroletogaintheassociatedpermissionsforasession.
n7 n 7 q n7 n7 n7 n7 n7 n7




• LeastPrivilege: Usersshouldonlyhavetheminimumlevel ofaccessnecessarytoperformtheirjob
n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7




duties.
n7




The organization's access control structure, as seen in the user matrix, is implicitly role-based (e.g.,
n 7 n 7 n 7 n 7 n 7 n 7 n 7 n 7 n 7 n7 n 7 n 7 n7 n 7




n”Finance manager,” ”HRcoordinator”). Applying a formal RBACmodel would streamlinethis by ensuring
7 n7 n 7 n 7 n7 n 7 n 7 n 7 n7 n 7 n7




npermissions arestrictlytiedtobusinessfunctions,reducingcomplexityandthepotentialforusererrorwhen
7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7




assigning permissions.
n7 n7




A.2. FourMisalignments withRBACPrinciples n7 n7 n7 n7




1. Misalignment 1: Privilege Escalation Beyond Role Scope n7 n 7 n7 n7 n 7 n7




• Description: The ”Juniorsystem admin” (J. Lopez) has ”Domain admin” privileges. A n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7




juniorroleshouldnothavethehighestlevelofaccessinaWindowsenvironment.
n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7




• Conflict with RBAC: Thisviolates theprinciple ofleast privilege. The role ”Junior system n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7




admin” implies asubsetofadministrative duties, notunrestricted domain-wide
n7 n 7 n 7 n 7 n 7 n 7




control. n 7




2. Misalignment2: UnnecessaryAccess AcrossDepartments n7 n7 n7 n7 n7




• Description:The”Financeanalyst”(L.Cheng)has”Fullaccess”totheCRM,asystem n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7




primarilyforSales and Support. Afinance roletypically does not require full modification rights
n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7




in a customer relationship system. n7 n7 n7 n7 n7




• Conflict with RBAC: Thisviolates least privilege and separation ofduties. Itallowsfor n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7




• potential datamanipulation outsidetheuser'scorebusinessfunction. n7 n7 n7 n7 n7 n7 n7 n7




?

,3. Misalignment3: Violation ofUser-RoleAssignment Post-Termination
7
n n7 n7 7
n 7
n n7




• Description: The"HRassistant" (P. Ellis), who was terminatedon2025-05-20, has an
7
n 7
n 7
n 7
n 7
n 7
n 7
n 7
n




"Active" account status and successfully logged in on 2025-06-29.
n7 n7 n7 n7 n7 n7 n7 n7 n7




• Conflictwith RBAC: RBAC requires timely revocationof role assignments upon a change in
7
n n7 n7 n7 n7 7
n n7 7
n n7 n7 n 7




employment status. An active session for a terminated user completely bypasses the
n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7




security provided by the role structure.
n7 n7 n7 n7 n7 n7




4. Misalignment4: OverlyBroad PrivilegedAccess
7
n n7 7
n n7 n7




• Description: The "IT administrator" (T. Miller) has "Full admin" access to "All internal
7
n 7
n 7
n n7 n7 n7 7
n n7 n7 7
n 7
n n7




systems," and the log shows they made a firewall rule change without a ticket_id.
n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7 n7




• ConflictwithRBAC:Whilesomeaccessisnecessary, blanket"Full admin" access
7
n 7
n 7
n n7 7
n n 7 n7




?

, vioIatesIeastpriviIegeandimpedesaccountabiIity.Itdoesnotsegmentdutieswithinthe IT department
7
n 7
n 7
n 7
n 7
n n7 7
n 7
n 7
n 7
n 7
n n7 n7




itseIf.
n7




?