Learn how physical access controls protect assets. Physical access control is visible and tangible, directly protecting systems, equipment and facilities by controlling access and controlling the environment, and indirectly protecting information and applications by restricting physical access.
Learn how logical access control protects assets. Logical access controls include authentication, authorization, and permissions that limit who can access information stored on systems and devices, as well as restrict access to system and device settings.
Understand the difference between subject and object. You'll find that CISSP exam questions and security documents often use the terms "subject" and "object," so it's important to understand the difference between the two. A principal is an active entity (such as a user) that accesses a passive object (such as a file). Users are the subjects who access objects when performing certain operations or completing work tasks.
Learn the difference between identity and authentication. Access control relies on valid identification and authentication, so it's important to understand the difference between the two. The subject declares an identity, which can be as simple as a username. A principal proves its identity by providing authentication credentials (such as a password that matches a username).
Learn about identity creation, registration, and proof. New employees have their identity established through official documentation such as a passport, driver's license or birth certificate. The HR colleague then begins the registration process, which includes creating an account for the new employee. When biometric authentication is used, the registration process also collects biometric data. Identity proof includes knowledge-based authentication and cognitive passwords. Cognitive passwords ask the user a series of questions that only the user knows.
Understand the difference between delegation and accountability. After the subject is authenticated, the system will grant the sub-subject access rights to the object based on the proven identity. Audit logs and audit trails record events, including the identity of the principal who performed the action. Accountability requires a combination of effective identification, authentication and auditing.
Learn more about key authentication factors. The three main factors of authentication are "what you know" (such as a password or PIN), "what you have" (such as a smart card or token), and "what you are" (based on biometrics). Multi-factor authentication consists of two or multiple authentication factors, is more secure than using a single authentication factor. Passwords are the weakest form of authentication, but password policies help improve security by enforcing password complexity and history requirements. Smart cards include micro-cards. Processor and encryption certificate, while the token generates a one-time password. Biometric methods identify users based on characteristics such as fingerprints. The Cross Error Rate (CER) reflects the accuracy of the biometric method and is the False Rejection Rate (FRR) equal to the False Acceptance. rate (FAR) position.
Learn about single sign-on. The mechanism of single sign-on allows a subject to authenticate once on the system and access multiple resources without having to authenticate again.
Describe how to implement a federated identity management system. FIM systems can be hosted on-premises (providing maximum control), implemented via a third-party cloud service, or the two can be combined into a hybrid system.
Describe just-in-time (JIT) supply. The 1T configuration creates a user account when the user logs in to a third-party site for the first time. JIT reduces administrative burden.
Learn about proband management systems. Credential management systems help developers easily store usernames and passwords and retrieve them when users revisit the website. The Credential Management API was published as a working draft by the W3C in 2019 and is commonly used by developers as a credential management system. Credential management systems allow users to automatically log into websites without having to enter their credentials again.
Explain session management. The session management process prevents unauthorized access by closing idle sessions. Developers often use web frameworks to implement session management. These frameworks allow developers to ensure that sessions are closed after being idle for a certain amount of time, such as 2 minutes.
Understand the identity and access configuration lifecycle. The identity and access provisioning lifecycle refers to the creation, management, and deletion of accounts.
The provisioning process ensures that accounts are assigned the appropriate permissions based on task requirements and that employees have access to the required hardware devices.
People processes inform employees about organizational processes. When an employee leaves, the deprovisioning process disables or deletes the account, and the offboarding process ensures that employees return all hardware issued to them by the organization.
Explain the importance of role definition. When an organization creates new job roles, it is important to determine the permissions these new roles require. Doing this ensures that employees in these new roles do not have excessive permissions.
Describe the purpose of account access review. Conduct account access reviews of user accounts, system accounts, and service accounts. These reviews ensure that accounts do not have excessive permissions. Account access audits can often detect when accounts have too many permissions and when unused accounts have not been disabled or removed.
Wondershare EdrawMind
