5.0 Inside the Empire Authentication Authorization and Access Controls PowerPoint

Authentication

The process of verifying the identity of a user or device.

Authorization

The right or permission granted to a system entity to access a system resource.

Access Controls

Security measures that regulate who can view, use, or modify resources within an information system.

Principle of Least Privilege (PoLP)

Mandates that users and programs should have only the minimum level of access necessary to complete their tasks.

Single-Factor Authentication (SFA)

Use of just one of the three available factors to carry out the authentication process.

Two-Factor Authentication (2FA)

A security process that requires two distinct forms of identification to verify a user's identity.

Multi-Factor Authentication (MFA)

Using two or more distinct instances of the three factors of authentication for identity verification.

User Provisioning

The process of creating, maintaining, and deactivating user identities on a system.

Access Control Lists (ACLs)

Specify individual user or system process permissions to access specific system objects.

Logical Access Control Systems (LACS)

Automated systems that control an individual’s ability to access computer system resources.

Biometric Authentication

Utilizing unique physical characteristics to secure highly sensitive data.

Attribute-based Access Control (ABAC)

Policies that consider various attributes such as user role, time of access, location, and resource type.

Discretionary Access Control (DAC)

Access control left to the discretion of the object’s owner.

Mandatory Access Control (MAC)

Requires the system to manage access controls based on security policies.

Role-based Access Control (RBAC)

Assigns permissions to users based on their roles within an organization.

Just-In-Time Access (JIT)

Provides temporary elevated access only for the duration necessary to complete specific tasks.

Access Logging and Monitoring

Keeping detailed and secure logs of access events to identify unauthorized activity.

Regular Access Reviews

Periodically reviewing and adjusting access permissions to align with current roles.

Security Controls

Measures implemented to protect physical assets, organizational policies, and technical systems.

Physical Controls

Tangible measures to protect physical assets, infrastructure, hardware, and facilities.

Administrative Controls

Policies, procedures, and guidelines designed to manage an organization's overall security posture.