2 Secure Design and Access Control Free Online FlashCards

What is the goal of secure architecture?

Secure architecture builds protection into system structure and operations throughout the system life cycle.

What does least privilege require?

Give each user, service, and process only the access needed for its assigned tasks.

What is complete mediation?

Check authorization whenever a protected resource or action is requested, not only at login or session start.

What does it mean to fail securely?

If an authorization decision cannot be made, deny the request rather than granting access by default.

Why use separation and isolation in system design?

Divide sensitive functions and limit communication between components so a compromise is less likely to spread.

What is defense in depth?

Combine complementary safeguards so that one control's failure does not expose the entire system.

What does identity represent in access control?

Identity represents the claimed user, device, or service requesting access.

What is authentication?

Authentication verifies a claimed identity, for example by using a password and a separate authentication factor.

What does authorization determine?

Authorization decides whether an authenticated subject may perform a particular action on a resource.

How does role-based access control (RBAC) assign permissions?

RBAC assigns permissions to job or service roles, and subjects receive access through those roles.

What information can attribute-based access control (ABAC) use?

ABAC bases access decisions on attributes such as subject role, resource sensitivity, requested action, or current context.

How should access be assigned to an automated workload?

Give each workload its own identity and permissions instead of sharing a powerful account or embedding credentials in code.