Similarly, objects are also grouped together, such as grouping files within folders or shares to simplify administration. Subjects are often grouped together by using roles or groups to simplify administration. A subject (such as a user) can access an object (such as a file or other resource).

Job rotation policies help prevent fraud by ensuring that a person does not remain in the same position for an extended period and gain excessive control over any area of the business.Īccess Control policies commonly refer to subjects and objects.It helps prevent fraud by requiring two or more people to conspire together. A separation of duties policy ensures that no single entity can control an entire process.Least privilege refers to the practice of granting subjects access only to what they need to perform their jobs and no more.Users should reread and acknowledge the AUP periodically, such as once a year. An acceptable use policy (AUP) informs users of their responsibilities when using IT systems and identifies unacceptable behaviors.Security policies commonly include one or more of the following elements: The security policy provides a high-level overview of generalized goals, and it is used to create more specific guidelines, standards, and procedures. Which is stronger?ĭecentralized/distributed access control techniquesįor example: What XML-based standards are used to provide SSO capabilities in a federated identity management system?įor example: How does a constrained user interface control access? What are the differences among an access control list, a capability table, and an access control matrix?įor example: What is provided by an audit trail? What is included in log management?Īt the heart of any access control strategy is one or more security policies that identify the overall security goals of an organization. Another model requires users to use a smart card and a PIN. Techniques (for example, non-discretionary, discretionary, and mandatory)įor example: What is a commonly used non-discretionary model that organizes users into groups?įor example: One authentication method requires users to enter a password and a PIN. Types of controls (preventive, detective, corrective, and so on)įor example: What type of control is an audit trail? What type of control is a security guard? Exam need to know…įor example: Do you know and understand the common elements of a security policy, such as the principle of least privilege and separation of duties? What is an acceptable use policy? You should have an understanding of federated identity management systems and some of the XML-based protocols that they use to share authentication information. Single sign-on (SSO) authentication methods have been widely available within a single organization’s environment, but newer methods support SSO in federations. Without effective authentication, it isn’t possible to enforce authorization and data within audit trails is not useful. At the core of access control is effective authentication, and it’s important to understand the authentication factors. Personnel within the organization then implement different types of controls to support the policy. Security policies provide overall direction for an organization. Objective 1.1: Control access by applying the following concepts/methodologies/techniquesįor this exam objective, you must understand many of the basics related to IT risk management. Objective 1.4: Identity and access provisioning lifecycle (e.g., provisioning, review, revocation).Objective 1.3: Assess effectiveness of access controls.Objective 1.2: Understand access control attacks.Objective 1.1: Control access by applying the following concepts/methodologies/techniques.This chapter covers the following objectives: These reviews and audits can also detect problems in the identity and access provisioning life cycle, such as inactive accounts that have not been disabled. Ideally, access controls are implemented to fully support an organization’s security policy, and a way to verify this is through access reviews and audits. Access control attacks are common, and it’s important for security professionals to have a basic understanding of evaluating threats and analyzing vulnerabilities to determine overall risk.

Audit trails are an important element of accounting and logging and, combined with effective authentication, provide individual accountability. The Access Control domain covers a variety of different controls used to identify subjects, authenticate them, and control the access they are granted to different objects by controlling rights and permissions.

I see password review trail