ISC2 CC Domain 3: Access Control Concepts

principle of least privilege (PoLP)

users granted only minimum access necessary to perform their tasks

purpose of PoLP

limit potential dmg from malicious actions

how to implement PoLP

• role-based permissions

• regularly review access rights

• enforce strict access controls

benefits of PoLP

• reduce security risk from compromised accounts

• simplifies auditing and compliance

• improve overall system stability

segregation of duties SoD

divide critical tasks among multiple users to prevent fraud, errors and unauthorized actions

purpose of SoD

1. reduce internal threats

2. ensure no one person has complete control over sensitive operations

SoD involves the division of responsibilities into the following 3 processes:

1. request

2. approval

3. execution

example of SoD in financial transactions

1. purchasing

2. payment processing

3. record keeping

logical access controls

1. DAC discretionary access controls

2. MAC mandatory access controls

3. RBAC role based access controls

DAC Discretionary Access Controls

flexible access model where the resource owner determines WHO can access it and WHAT they can do

advantage of DAC

flexible and user-friendly

disadvantage of DAC

owner may grant excessive access → risk of misuse → less secure

MAC Mandatory Access Control

strict access control where the permissions are enforced by central authority based on security classifications

disadvantage of MAC

• inflexible (users cannot change access permissions)

• complex to manage

example of MAC

documents being labeled as confidential, secret or top secret

RBAC Role-Based Access Control

access permissions based on user’s role in organization

advantages of RBAC

• simplifies management

• improve scalability

• ensure consistent access rights

disadvantages of RBAC

be cautious to not grant excessive perms

physical security

protection of physical assets like hardware and data centers

key components of physical security

1. access controls — ie biometric authentication

2. perimeter security — fences and cameras, bollards

3. environmental controls — fire suppression, power backup

purposes of access badges

1. identification and authentication

2. access restriction

3. tracking and auditing

4. multifactor integration

5. deterrence

6. lost/stolen badge management

types of sensors

1. infrared

2. pressure

3. microwave

4. ultrasonic

infrared sensor

cameras detect heat

pressure sensor

floors and mats

microwave sensors

detect movement

ultrasonic sensors

parking assistance, intrusion detection, robotic navigation

physical security monitoring systems

1. video surveillance — detective, deterrent

2. security guards — detective, deterrent, preventative

3. lighting — deterrence, detection