Authorization & Access Control Flashcards

What is the primary function of access control in cybersecurity?

Answer: To regulate and limit access to authorized users

The primary function of access control in cybersecurity is to enforce policies that determine who can access specific resources, what actions they can perform, and under what circumstances. It ensures that only authorized individuals or systems can gain entry to sensitive data, applications, or networks, thereby preventing unauthorized access and protecting information integrity and confidentiality.

Which of the following is a common access control model?

Answer: Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) is a widely adopted access control model that assigns permissions to users based on their job functions or roles within an organization. This simplifies access management by granting rights to roles rather than individual users, ensuring that individuals only have the necessary access for their responsibilities. RBAC enhances security by centralizing control and reducing the risk of excessive or unauthorized privileges.

Why is multifactor authentication (MFA) important for access control?

Answer: It adds an extra layer of authentication

Multifactor authentication (MFA) is crucial for access control because it significantly enhances security by requiring users to provide two or more distinct verification factors. This means that even if one factor, such as a password, is compromised, an attacker would still need the second factor (e.g., a code from a phone or a fingerprint) to gain access. This additional layer makes it much harder for unauthorized individuals to breach accounts, thereby protecting sensitive information.

Which access control principle ensures users only have the minimum necessary permissions?

Answer: Principle of Least Privilege (PoLP)

The Principle of Least Privilege (PoLP) is a fundamental security concept that ensures users and processes are granted only the minimum necessary permissions to perform their legitimate tasks. By limiting access rights, PoLP reduces the attack surface and minimizes the potential damage if an account is compromised. This prevents unauthorized actions, helps maintain system integrity, and is a cornerstone of robust access control.

What is the purpose of an access control list (ACL)?

Answer: To define and enforce access permissions

An Access Control List (ACL) is a list of permissions attached to an object, such as a file or directory, that specifies which users or system processes are granted access and what operations they are allowed to perform. ACLs are crucial for defining and enforcing granular access control, ensuring that only authorized entities can interact with specific resources. They act as a gatekeeper, dictating who can read, write, or execute data.

How does biometric authentication improve access control?

Answer: It verifies identity using unique physical traits

Biometric authentication improves access control by verifying identity using unique physical or behavioral traits, such as fingerprints, facial patterns, or iris scans. This method is highly secure because biometric traits are difficult to forge, steal, or forget, unlike passwords. It offers a convenient and robust way to confirm a user's identity, significantly strengthening the authentication process and reducing the risk of unauthorized access.