4.2 Access Controls

Access controls are a set of security features that regulate who has access to resources and information within a network. The aim is to ensure that only authorized personnel can access sensitive information and resources while preventing unauthorized access.

There are three main types of access controls:

  1. Physical Access Controls: Physical access controls are measures designed to limit access to areas where sensitive information is stored. They include security measures such as locks, security cameras, and access control systems.
  2. Technical Access Controls: Technical access controls are measures designed to limit access to digital resources. They include firewalls, intrusion detection systems, and antivirus software.
  3. Administrative Access Controls: Administrative access controls are measures that govern how access is granted and managed. They include user authentication and authorization processes, policies, and procedures.

Best practices for access controls include the following:

  1. Role-Based Access Control: Access controls should be based on the principle of least privilege. This means that users should only have access to the resources they need to do their job.
  2. Multi-Factor Authentication: Multi-factor authentication is a security measure that requires users to provide two or more pieces of information to verify their identity.
  3. Regular Access Reviews: Access reviews are essential to ensure that users only have access to resources they need to do their job.
  4. User Education: Users should be educated on the importance of access controls and their role in maintaining security.
  5. Access Monitoring: Access to sensitive resources should be monitored to detect any unauthorized access or suspicious activity. Regular security audits should also be conducted to identify any potential vulnerabilities and address them proactively.

Quizes for Topic 2:

Single
Choice
Multiple
Choice
"Free"
Choice
Sorting
Choice
Matrix 
Sorting
Fill in the
Blank
Assessment
(Survey)

What is the definition of access controls?

Techniques used to prevent unauthorized access to systems or data✅
The ability to access information quickly
A form of encryption that uses public and private keys

What are the types of access controls?

Physical, technical, and administrative✅
Symmetric, asymmetric, and hashing
Public, private, and hybrid

Which of the following is a best practice for access controls?

Regularly review access rights and permissions✅
Provide unrestricted access to all users
Share login credentials with others

What is an example of a physical access control?

Biometric authentication✅
Firewall configuration
Password policies

What is an example of a technical access control?

Role-based access control✅
Video surveillance
Security awareness training

Which of the following is a type of access control?

Mandatory Access Control
Physical Access Control
Role-Based Access Control
All of the above✅
None of the above

What is the definition of access controls?

A way to prevent unauthorized access to resources
A method for encrypting data
A type of firewall
All of the above
None of the above✅

Which of the following is a best practice for access controls?

Use strong passwords
Implement multi-factor authentication
Regularly review and update access rights
All of the above✅
None of the above

What is the purpose of access controls?

To provide confidentiality of data
To prevent unauthorized access to resources✅
To encrypt data
To ensure data integrity
None of the above

Which of the following is a type of access control?

Mandatory Access Control
Physical Access Control
Discretionary Access Control
All of the above✅
None of the above

The process of granting or denying users access to resources is known as ______ .

Access control
Hint:
Access control

The principle of granting access to only those who need it for their job function is known as the principle of ______ .

least privilege
Hint:
least privilege

The practice of periodically reviewing and removing unnecessary or outdated user access is known as access ______ .

recertification
Hint:
recertification

The process of verifying the identity of a user or device is known as ______ .

authentication
Hint:
authentication

The act of a user assuming the identity of another user to gain access to resources is known as ______ .

impersonation
Hint:
impersonation

Sort the following best practices for access controls by the level of difficulty in implementing them, from easiest to most difficult.

User Education
Multi-Factor Authentication
Regular Access Reviews
Role-Based Access Control
Access Monitoring
Hint:
User Education
Multi-Factor Authentication
Regular Access Reviews
Role-Based Access Control
Access Monitoring

Sort the following types of access controls by how effective they are at preventing unauthorized access, from most effective to least effective.

Technical access controls
Administrative access controls
Physical access controls
Hint:
Technical access controls
Administrative access controls
Physical access controls

Sort the following types of access controls by how frequently they are used in modern security environments, from most frequently used to least frequently used.

Physical access controls
Technical access controls
Administrative access controls
Hint:
Physical access controls
Technical access controls
Administrative access controls

Sort the following access controls by importance, from most important to least important.

Physical access controls
Technical access controls
Administrative access controls
Hint:
Physical access controls
Technical access controls
Administrative access controls

Sort the following best practices for access controls by importance, from most important to least important.

Role-Based Access Control
Multi-Factor Authentication
Regular Access Reviews
User Education
Access Monitoring
Hint:
Role-Based Access Control
Multi-Factor Authentication
Regular Access Reviews
User Education
Access Monitoring

Please match the following definitions:

A security principle that limits access to resources
Access control
A way of limiting user actions based on their role
Role-based access control
A method for verifying a user's identity
Authentication
A security principle that involves dividing permissions among multiple entities
Least privilege
A type of authentication that uses a physical characteristic to identify a user
Biometric authentication
Hint:
A security principle that limits access to resources ➢ Access control
A way of limiting user actions based on their role  ➢ Role-based access control
A method for verifying a user's identity ➢ Authentication
A security principle that involves dividing permissions among multiple entities ➢ Least privilege
A type of authentication that uses a physical characteristic to identify a user  ➢ Biometric authentication

Please match the following definitions:

A security principle that ensures that information is only available to those who are authorized to view it
Confidentiality
A way of limiting user actions based on a predetermined set of rules
Rule-based access control
A method of verifying that an individual is who they say they are
Identity verification
A security principle that involves giving users the minimum access necessary to complete their job
Principle of least privilege
A type of access control that assigns permissions to specific individuals
Discretionary access control
Hint:
A security principle that ensures that information is only available to those who are authorized to view it ➢ Confidentiality
A way of limiting user actions based on a predetermined set of rules ➢ Rule-based access control
A method of verifying that an individual is who they say they are ➢ Identity verification
A security principle that involves giving users the minimum access necessary to complete their job ➢ Principle of least privilege
A type of access control that assigns permissions to specific individuals ➢ Discretionary access control

Please match the following definitions:

A security principle that ensures that information is not modified by unauthorized parties
Integrity
A type of access control that assigns permissions based on a predetermined set of rules
Rule-based access control
A method for verifying a user's identity using a password or PIN
Knowledge-based authentication
A security principle that involves giving users access only to resources that are necessary to complete their job
Least privilege
A type of access control that assigns permissions based on the user's job responsibilities
Role-based access control
Hint:
A security principle that ensures that information is not modified by unauthorized parties ➢ Integrity
A type of access control that assigns permissions based on a predetermined set of rules ➢ Rule-based access control
A method for verifying a user's identity using a password or PIN  ➢ Knowledge-based authentication
A security principle that involves giving users access only to resources that are necessary to complete their job ➢ Least privilege
A type of access control that assigns permissions based on the user's job responsibilities  ➢ Role-based access control

Please match the following definitions:

A security principle that ensures that information is available when needed
Availability
A type of authentication that involves using a smart card to verify a user's identity
Smart card authentication
A method of verifying a user's identity using a physical characteristic such as a fingerprint or iris scan
Biometric authentication
A security principle that involves giving users access only to resources that they are authorized to use
Authorization
A type of access control that assigns permissions based on the sensitivity of the data
Mandatory access control
Hint:
A security principle that ensures that information is available when needed ➢ Availability
A type of authentication that involves using a smart card to verify a user's identity ➢ Smart card authentication
A method of verifying a user's identity using a physical characteristic such as a fingerprint or iris scan ➢ Biometric authentication
A security principle that involves giving users access only to resources that they are authorized to use ➢ Authorization
A type of access control that assigns permissions based on the sensitivity of the data ➢ Mandatory access control

Please match the following definitions:

A security principle that ensures that information is available only to authorized individuals
Confidentiality
A type of access control that assigns permissions based on the user's job responsibilities
Role-based access control
A method for verifying a user's identity by sending a code to their mobile device
Two-factor authentication
A security principle that involves dividing permissions among multiple entities
Least privilege
A type of access control that assigns permissions based on a predetermined set of rules
Rule-based access control
Hint:
A security principle that ensures that information is available only to authorized individuals ➢ Confidentiality
A type of access control that assigns permissions based on the user's job responsibilities ➢ Role-based access control
A method for verifying a user's identity by sending a code to their mobile device ➢ Two-factor authentication
A security principle that involves dividing permissions among multiple entities ➢ Least privilege
A type of access control that assigns permissions based on a predetermined set of rules ➢ Rule-based access control

Fill in the blank:

The process of granting or denying users access to resources is known as {Access control} .

Hint:
Access control

Fill in the blank:

The principle of granting access to only those who need it for their job function is known as the principle of {least privilege} .

Hint:
least privilege

Fill in the blank:

The practice of periodically reviewing and removing unnecessary or outdated user access is known as access {recertification} .

Hint:
recertification

Fill in the blank:

The process of verifying the identity of a user or device is known as {authentication} .

Hint:
authentication

Fill in the blank:

The act of a user assuming the identity of another user to gain access to resources is known as {impersonation} .

Hint:
impersonation

On a scale of 1 to 5, how confident are you in your understanding of access controls?

Not at all confident { [1] [2] [3] [4] [5] } Extremely confident

Have you ever implemented access controls in a professional or personal setting?

{ [Yes] [No] }

On a scale of 1 to 5, how important do you think access controls are for data security?

Not at all important { [1] [2] [3] [4] [5] } Extremely important

On a scale of 1 to 5, how likely are you to implement or improve access controls in your current or future workplace?

Not at all likely { [1] [2] [3] [4] [5] } Extremely likely
Copyright © TrueTandem