Computer Security: Principles and Practice, 4th Edition Chapter4 -Access Control

Access control

1. __________ implements a security policy that specifies who or what may have access to each specific system resource and the type of access that is permitted in each instance.

role

A __________ is a named job function within the organization that controls this computer system

subject

A __________ is an entity capable of accessing objects.

mandatory access control

A concept that evolved out of requirements for military information security is ______ .

T

A user may belong to multiple groups.

object

A(n) __________ is a resource to which access is controlled.

T

Access control is the central element of computer security.

T

An access right describes the way in which a subject may access an object.

T

An auditing function monitors and keeps a record of user accesses to system resources.

ABAC

Subject attributes, object attributes and environment attributes are the three types of attributes in the __________ model.

access management

The __________ component deals with the management and control of the ways entities are granted access to resources.

Object

The basic elements of access control are: subject, __________, and access right.

T

The principal objectives of computer security are to prevent unauthorized users from gaining access to resources, to prevent legitimate users from accessing resources in an unauthorized manner, and to enable legitimate users to access resources in an authorized manner.

Environment

The three types of attributes in the ABAC model are subject attributes, object attributes, and _________ attributes.

F

Traditional RBAC systems define the access rights of individual users and groups of users.

Authorization

_________ is the granting of a right or permission to a system entity to access a system resource.

MAC

__________ controls access based on comparing security labels with security clearances.

RBAC

__________ is based on the roles the users assume in a system rather than the user's identity.

DAC

__________ is the traditional method of implementing access control.

Authentication

__________ is verification that the credentials of a user or other system entity are valid.

Constraints

__________ provide a means of adapting RBAC to the specifics of administrative and security policies in an organization.

Cardinality

__________ refers to setting a maximum number with respect to roles.