This lesson introduces access control as a central security practice and explains how policies guide decisions about access.
Access control is the process of deciding whether a subject should be allowed to access an object. Access can mean entering a place, using a service, or consuming or changing a resource. In digital systems, access control is also called admission control.
All flashcards
What is access control?
The practice of deciding whether a subject may access an object, such as a resource, service, or physical place.
What is an access-control policy?
A set of organizational rules that describes which subjects may access which resources and under what conditions.
What is the principle of least privilege?
Give each user or process only the permissions necessary for its assigned tasks, and no unnecessary permissions.
What are subjects and objects?
A subject is an entity that can perform an action; an object is a resource on which access may be controlled.
What does accountability provide?
It helps identify and review actions performed by a subject, often through records or audit trails.
Quiz questions
How do capability-based and ACL-based access-control models differ?Answer: A capability grants access through possession of a protected reference; an ACL lists permitted subjects for an object.
In role-based access control (RBAC), how do users typically receive permissions?Answer: Permissions are assigned to roles, and users receive permissions through their roles.
Which arrangement is an example of multi-factor authentication?Answer: Using a badge and a PIN to authenticate a person.
What is tailgating at a controlled entrance?Answer: An unauthorized person follows an authorized person through the entrance.
What is one characteristic of IP-based access-control systems?Answer: Controllers or readers can communicate over LAN or WAN infrastructure.
Based on the Wikipedia article Access control, licensed CC BY-SA 4.0. Adapted into a summary, flashcards and quizzes.