Lesson 3 Authorization and Access Control- WGU C836, top Questions and answers, rated A+

Lesson 3 Authorization and Access Control- WGU C836, top Questions and answers, rated A+ Attributes of a particular individual, such as height - ✔✔-Subject attributes allows us to specify where the party should be ...

Lesson 3 Authorization and Access Control- WGU C836, top Questions and answers, rated A+ Attributes of a particular individual, such as height - ✔✔-Subject attributes allows us to specify where the party should be allowed or denied access, and access control enables us to manage this access at a more granular level. - ✔✔-Authorization Authorization allows us to specify where the party should be allowed or denied access, and _________ enables us to manage this access at a more granular level. - ✔✔-access control dictates that we should only allow the bare minimum of access to a party—this might be a person, user account, or process - ✔✔-principle of least privilege What dictates that we should only allow the bare minimum of access, as needed? A Policy B User rights C Principle of least privilege D ACL - ✔✔-C Principle of least privilege four basics tasks of access controls - ✔✔-Allowing access, Denying access Limiting access and revoking access is simply a set of resources devoted to a program, process, or similar entity, outside of which the entity cannot operate. We use sandboxes to prevent their contents from accessing files, memory, and other system resources with which they should not be interacting - ✔✔-sandbox access controls, there are two main methods that we might use - ✔✔-access control lists and capabilities often referred to as "ackles," are a very common choice of access control implementation. are usually used to control access in the file systems on which our operating systems run and to control the flow of traffic in the networks to which our systems are attached. - ✔✔-Access control lists (ACLs) When we look at the ACLs in most file systems, we commonly see three permissions in use - ✔✔-read, write, and execute Permissions in network ACLs tend to be binary in nature, generally consisting of - ✔✔-allow and deny filtering can take the form of dropping traffic from individual IP addresses, to ranges, to the entire IP space of large organizations, ISPs, or even entire countries. This practice is commonly referred to as - ✔✔-blackholing FTP uses ports - ✔✔-20 and 21 to transfer files, Internet Message Access Protocol (IMAP) uses port - ✔✔-143 for managing e-mail Secure Shell (SSH) uses port - ✔✔-22 to manage remote connections to systems are oriented around the use of a token that controls our access. We can think of a token in a capability as being analogous to the personal badge we might use to open the door in a building - ✔✔-capabilities when the software with access to a resource has a greater level of permission to access the resource than the user who is controlling the software - ✔✔-Confused deputy problem Two of the more common client-side attack are - ✔✔-cross-site request forgery (CSRF) and clickjacking. are attacks that take advantage of weaknesses in applications that are running on the computer being operated directly by the user, often referred to as the client. - ✔✔-Client-side attacks is an attack that misuses the authority of the browser on the user's computer. If the attacker knows of, or can guess, a Web site to which the user might already be authenticated - ✔✔-CSRF most common access control models in security world are - ✔✔-discretionary access control, mandatory access control, rule-based access control, role-based access control, and attribute-based access control. is a model of access control based on access being determined by the owner of the resource in question. The owner of the resource can decide who does and does not have access, and exactly what access they are allowed to have - ✔✔-Discretionary access control (DAC) is a model of access control in which the owner of the resource does not get to decide who gets to access it, but instead access is decided by a group or individual who has the authority to set access on resources. - ✔✔-Mandatory access control (MAC) is, logically, based on attributes. These can be the attributes of a particular person, of a resource, or of an environment. - ✔✔-Attribute-based access control (ABAC) are used to control access, based on whether the party on the other end can pass a test that is, in theory, too difficult for a machine to complete, thus proving the party to be human. - ✔✔-Captchas model implements a combination of DAC and MAC and is primarily concerned with the confidentiality of the resource in question - ✔✔-Bell-LaPadula The level of access granted to an individual must be at least as high as the classification of the resource in order for the individual to be able to access it. - ✔✔-The simple security property In Bell-LaPadula, we have two security properties that define how information can flow to and from the resource - ✔✔-The simple security property and The * property Anyone accessing a resource can only write its contents to one classified at the same level or higher. - ✔✔-The * property is primarily concerned with protecting the integrity of data, even at the expense of confidentiality. - ✔✔- The Biba model of access control The level of access granted to an individual must be no lower than the classification of the resource. - ✔✔-The simple integrity axiom Anyone accessing a resource can only write its contents to one classified at the same level or lower. - ✔✔-The * integrity axiom Biba has two security rules that are the exact reverse of those we discussed in the Bell-LaPadula model - ✔✔-The simple integrity axiom and The * integrity axiom also known as the Chinese Wall model, is an access control model designed to prevent conflicts of interest - ✔✔-The Brewer and Nash mode