Chapter 5: Access Control Methods & Password Management

Comprehensive flashcards covering access control principles, password management strategies, cyber attack methods, Defense-in-Depth, Principle of Least Privilege, and Segregation of Duties based on the Chapter 5 lecture transcript.

What is the definition of Access Control in a computing environment?

A security technique that regulates who or what can view or use resources, and a data security process that enables organisations to manage authorised access to corporate data and resources.

What are the five key benefits of Access Control?

1. Protect sensitive data (student, financial, medical). 2. Prevent unauthorized access (hackers, insider threats). 3. Reduce cybersecurity risks (malware, data theft). 4. Improve accountability (tracking activities). 5. Support compliance (PDPA, company policies).

What are the five main components of Access Control?

Authentication, Authorisation, Access, Manage, and Audit.

Differentiate between Authentication and Authorisation as components of Access Control.

Authentication verifies the identity of the user (e.g., Password, Fingerprint, OTP), while Authorisation determines what the authenticated user is allowed to do (e.g., a Lecturer editing marks vs. a Student viewing results).

What activities are involved in the 'Manage' component of Access Control?

The administration and maintenance of user accounts, permissions, and security settings, such as creating accounts, resetting passwords, and assigning permissions.

What is the purpose of the 'Audit' component in Access Control?

Tracking and recording user activities for monitoring and investigation, including login logs, file access history, and failed login attempts.

How does the transcript define a Password Manager?

A software application designed to store and manage online credentials securely, helping users generate, store, and autofill complex passwords to reduce the risk of using weak or reused passwords.

List the key features of a Password Manager.

Secure Password Storage (vault), Password Generation, Auto-Fill and Auto-Login, Cross-Platform Sync, Two-Factor Authentication ($2FA$) Support, Secure Sharing, Security Alerts (for breaches), and a Digital Wallet.

According to the secure password management practices, what are the requirements for a strong password?

Use a mix of uppercase, lowercase, numbers, and symbols with a minimum length of $12$ characters.

Define Brute force attacks and Dictionary attacks.

Brute force attacks use trial and error to crack passwords. Dictionary attacks try a list of dictionary words, their derivatives with alphanumeric replacements, and leaked passwords or phrases.

What is Credential stuffing?

The automated use of stolen usernames and passwords to gain unauthorized access to online accounts by 'stuffing' them into multiple sites in parallel.

Explain Password spraying and Keylogging.

Password spraying is the use of a single password against many accounts to avoid lockouts. Keylogging is using software to track a user's keyboard strokes to steal credentials and PINs.

What is the core concept of Defense-in-Depth (DiD)?

Using multiple layers of security controls to protect systems and data, ensuring that if one layer fails, others still provide protection.

What are the specific layers of Defense-in-Depth described in the notes?

Outer Layer (Security Awareness), Middle Layer $1$ (Firewall), Middle Layer $2$ (Antivirus), Middle Layer $3$ (MFA), and Inner Layer (Data Protection/Encryption).

Define the Principle of Least Privilege (PoLP).

The principle that users should only receive the minimum access required to perform their job duties.

What are the benefits of the Principle of Least Privilege?

Reduces insider threats, limits malware damage, prevents accidental mistakes, and improves security control.

What is Segregation of Duties (SoD)?

A strategy where important tasks are divided among different people so that no single person controls everything or can complete a sensitive transaction alone.

Why does Segregation of Duties matter for an organization?

It prevents fraud, reduces human error through peer review, increases accountability by making actions traceable, and improves monitoring and oversight.

What are the risks of operating without Segregation of Duties (SoD)?

Fraud, unauthorized changes, hidden malicious activities, and a lack of accountability.