Developing Cybersecurity Programs and Policies

A set of flashcards covering key concepts related to access control management in cybersecurity.

Access Control

Security features that govern how users and processes interact with systems and resources, aimed to protect against unauthorized access.

Security Posture

The organization’s approach to access control, categorized as either Secure (default deny) or Open (default allow).

Default Allow

A model where, by default, no security is enforced, allowing open access to all users.

Default Deny

A model where access is unavailable by default until the necessary access control is altered to allow it.

Principle of Least Privilege

Granting users the minimum permissions necessary to perform their tasks, helping protect data and users.

Need-to-Know

A principle requiring users to have a demonstrated and authorized reason to access specific information.

Authentication

The process of verifying the identity of a person or device, usually through credentials.

Single-Factor Authentication

An authentication method that requires one factor for verification.

Multifactor Authentication

An authentication method that requires two or more factors for verification.

Authorization

The process of assigning authenticated subjects permission to carry out specific operations.

Access Control List (ACL)

A list used to determine access rights based on defined criteria.

Discretionary Access Control (DAC)

Access control where data owners determine who can access particular resources.

Role-based Access Control (RBAC)

Access control based on the roles individuals have within an organization.

Network Segmentation

The process of logically grouping network assets to enhance security.

Virtual Private Network (VPN)

A secure tunnel for transmitting data over an insecure network like the Internet.

Monitoring

The process of auditing and tracking what users do once they access a specific resource.

Acceptable Use Agreement

A policy that informs users that their activities may be monitored while using company resources.