Chapter 1-2: Access Controls and Identity Verification

Vocabulary flashcards covering key terms from access controls and identity verification concepts.

Access controls

Mechanisms (physical and logical) that protect assets by controlling who can access resources, what operations they can perform, and by providing accountability; actions are mediated and logged.

Physical controls

Tangible measures that restrict physical access to assets (e.g., locks, badges, barriers).

Logical controls

Software-based controls that regulate access to systems and data (e.g., authentication, authorization, logging).

Reference monitor concept

A theoretical model where every access to an object is mediated by a central mechanism enforcing the security policy.

Security kernel

The implementation of the reference monitor concept; the core component that enforces access control decisions.

Mediation

The process of enforcing access control by evaluating rules before granting access.

Subject

An active entity (user or process) requesting access to an object.

Object

A resource to be accessed (file, database, device, etc.).

Identification

The process by which a user asserts their identity to the system.

Authentication

Verification of a user's identity using one of three factors: knowledge, ownership, or characteristics.

Something you know

Knowledge-based authentication factor (e.g., password, PIN).

Something you have

Ownership-based authentication factor (e.g., token, smart card).

Something you are

Inherence-based authentication factor (e.g., fingerprint, iris).

Need to know

Restricting access to information to only what is necessary for a user's role.

Least privilege

Restricting a user's actions to only those required to perform their role.

Need to know vs least privilege

Need to know governs data access; least privilege governs user actions.

Centralized approach

Identity management where authentication, authorization, and accountability are handled by a single centralized system.

Decentralized approach

Identity management where each application manages its own authentication and authorization.

Hybrid approach

A combination of centralized and decentralized identity management.

Separation of duties

Dividing key processes among multiple people to reduce risk of fraud or error.

Accountability

Tracing actions to a specific subject to ensure responsibility for those actions.

Logging

Recording events and actions to monitor security and support audits.

Authorization

Granting access rights to a user after identity has been verified.