Ch 6: Access Controls - Key Terms

Access control

The process of protecting a resource so that it is used only by those allowed to use it; a particular method used to restrict or allow access to resources.

Access control list (ACL)

An implementation technique to control access to a resource by maintaining a table of authorized user IDs; also used to permit or deny IP packets to/from router and switch interfaces to managed IP traffic flow.

Access control policy

An organizational policy definition that defines how authorized users gain access to resources based on their role and job functions and duties. This policy defines the rules for how employees and authorized contractors are granted access and how their access is removed.

Accountability

Defininitions of the roles and responsibilities of key IT security employees and incident response team members and what they must do.

Authentication

The process of proving someone is the person or entity he or she claims to be.

Authentication, authorization, and accounting (AAA)

Core services provided by one or more central servers to help standardize access control for network resources.

Authorization

The process of deciding who is approved for access to specific resources.

Biometrics

A physiological or behavioral human-recognition system (e.g., fingerprint reader, retina scanner, or voice-recognition reader).

Chinese wall

A set of rules that makes sure no subject gets to objects on the other side of the "wall."

Cloud computing

The practice of using computing services that are hosted in a virtualized data center with remote access to the application and data (e.g., Software as a Service [SaaS] utilizes cloud computing).

Cloud service provider (CSP)

A type of company that maintains data centers with racks of server computers, each running multiple virtual machines, and is able to provide services to many clients simultaneously. Organizations of all types turn to this type of company to avoid having to maintain their own data centers.

Common Criteria for Information Technology Security Evaluation (Common Criteria)

ISO/IEC 15408 standard for computer security.

Constrained user interface

Software that allows users to enter only specific information and perform only specific actions.

Decentralized access control

A system that puts access control into the hands of people, such as department managers, who are closest to system users; there is no one entity to process access requests in this system.

DIAMETER

A popular centralized access control protocol that succeeded RADIUS and provides access control for stable and static workforces.

Discretionary access control (DAC)

A means of restricting access to objects based on the identity of subjects and/or groups to which they belong.

Identification

The process of providing credentials to claim to be a specific person or entity.

Logical access control

A mechanism that limits access to computer systems and network resources.

Mandatory access control (MAC)

A means of restricting access to an object based on the object's classification and the user's security clearance.

Multifactor authentication (MFA)

Using two or more types of authentication credentials to authenticate an identity.

Physical access control

A mechanism that regulates access to physical resources, such as buildings or rooms.

Privacy

The protection of individual rights to nondisclosure.

Remote Authentication Dial-In User Service (RADIUS)

Popular protocol, first introduced in the early 1990s, that supports remote user authentication for large numbers of users wishing to connect to central servers.

Role-based access control (RBAC)

An access control method that bases access control approvals on the jobs the user is assigned.

Security kernel

The central part of a computing environment's hardware, software, and firmware that enforces access control for computer systems.

Single sign-on (SSO)

A method of access control that allows a user to log on to a system and gain access to other resources within the network via the initial logon. SSO helps a user avoid having to log on multiple times and remember multiple passwords for various systems.

Smart card

A plastic card with authentication credentials embedded in either a microchip or magnetic strip on the card.

Terminal Access Controller Access System Plus (TACACS+)

A Cisco proprietary remote access client/server protocol that provides authentication, authorization, and accounting.

Token

A physical device that transmits a secret code to a user to authenticate the user. Can be a hardware-device token or a software-generated token.