Cyberops Associate Chapter 3 With Complete Solutions
access controls
the administrative, physical and technical controls that control the interaction between
a subject and an object
objective is to grant, deny or revoke access to a particular object
subject
Any active entity that is requesting access to a resource
Commonly acting on behalf of a principal
object
Protected as the passive entity that is, or contains the information needed by the subject
four building blocks or process that charactice access controls
identification
authentication
authorization
accounting
identification
identification
process of giving the identity of a subject user - who are you
ex: user ID, IP addess
,authentication
process of proving the identity of a subject or user
can you prove who you are claiming to be?
ex: badge, fingerprint, password
authentication by knowledge
user gives a secret that only he or she knows
ex: password, pin
disadvantage: once info is compromised or lost, an attacker would be able to gain
successful authentication
authentication by ownership
user is prompted to present evidence that he or she possesses something unique
ex: smart card, badge, token
drawback: if object is stolen or misplaced, an intruder would be able to authenticate
successfully
authentication by trait
something the user does - physiological or behavioral
"biometric attribute
ex: fingerprint, hand geometry, keystroke dynamic, facial recognition, voice
drawback: susceptible to accuracy errors
A Type 1 Error
"false rejection rate FRR when a system rejects a valid user who should have been
authenticated "
A Type 2 Error
"false acceptance rate FAR" is when the system accepts a user that should have been
rejected"
, "Crossover error rate CER " equal error rate EER
when the FRR and the FAR are equal"
"multifactor authentication
When more than one authentication methods "
"Authorization
the process of giving a subject access to an object or resource
ex: user a can access resource B in read and write mode
implicit deny
if no rule is specified for the transaction of the subject/object, the authorization policy
should deny the transaction
need to know
a subset should be granted access to an object only if the access is needed to carry out
the job of a subject
accounting
process of auditing and monitoring what a user does once a specific resource is
accessed
what have you done to the asset?
ex: user a has edited resource B on 4th of July 2024
access control stages
asset or data classification
asset marking
access policy definition
data disposal
access controls
the administrative, physical and technical controls that control the interaction between
a subject and an object
objective is to grant, deny or revoke access to a particular object
subject
Any active entity that is requesting access to a resource
Commonly acting on behalf of a principal
object
Protected as the passive entity that is, or contains the information needed by the subject
four building blocks or process that charactice access controls
identification
authentication
authorization
accounting
identification
identification
process of giving the identity of a subject user - who are you
ex: user ID, IP addess
,authentication
process of proving the identity of a subject or user
can you prove who you are claiming to be?
ex: badge, fingerprint, password
authentication by knowledge
user gives a secret that only he or she knows
ex: password, pin
disadvantage: once info is compromised or lost, an attacker would be able to gain
successful authentication
authentication by ownership
user is prompted to present evidence that he or she possesses something unique
ex: smart card, badge, token
drawback: if object is stolen or misplaced, an intruder would be able to authenticate
successfully
authentication by trait
something the user does - physiological or behavioral
"biometric attribute
ex: fingerprint, hand geometry, keystroke dynamic, facial recognition, voice
drawback: susceptible to accuracy errors
A Type 1 Error
"false rejection rate FRR when a system rejects a valid user who should have been
authenticated "
A Type 2 Error
"false acceptance rate FAR" is when the system accepts a user that should have been
rejected"
, "Crossover error rate CER " equal error rate EER
when the FRR and the FAR are equal"
"multifactor authentication
When more than one authentication methods "
"Authorization
the process of giving a subject access to an object or resource
ex: user a can access resource B in read and write mode
implicit deny
if no rule is specified for the transaction of the subject/object, the authorization policy
should deny the transaction
need to know
a subset should be granted access to an object only if the access is needed to carry out
the job of a subject
accounting
process of auditing and monitoring what a user does once a specific resource is
accessed
what have you done to the asset?
ex: user a has edited resource B on 4th of July 2024
access control stages
asset or data classification
asset marking
access policy definition
data disposal
