Congratulations on completing the Access Controls Concepts
for the Certified in Cybersecurity course.
Let's take a look at the important things we covered in this domain.
We've often said that in actual fact,
access control is the heart of a security program.
On the exam, it's worth 22% of the final exam content,
but the concepts covered here are important so we understand
how to limit that only authorized people can perform
authorized functions on our systems.
We divided this into three main areas,
the concepts of access controls themselves,
and then we looked at both physical access and logical access types of controls.
When we looked at the access controls concepts,
we understood the important terms we've often used here.
For example,
we've said that the purpose of this is to ensure that
authorized people can only perform authorized functions,
unauthorized people can't do anything,
and even authorized people cannot perform an unauthorized function.
As we saw,
this is really why it's quite fair to say access controls are the heart and
center of our security strategy or our security program.
Some of the key points we looked at include things like describing
how access permissions or privileges are set up,
including concepts like least privilege,
need to know, and separation of duties.
We saw how least privilege meant a person was limited to only the
things they needed to do in order to do their job.
Based on concepts like business need to know,
for example,
we tried to make sure that people couldn't see things
that they shouldn't need to see even.
And separation of duties made sure that no one controlled a
sensitive transaction all the way through the process.
Instead, we broke it up with things like dual control and mutual exclusivity.
So if one person had to input something,
somebody else had to review and approve it.
When we looked at physical access controls,
we know that this is actually more important than we often recognize.
In many ways,
physical access control is as important or more so than a logical control
because it doesn't matter if you have a 15‑character password,
a logical control, if a person can steal the server.
Then your password does you no good.
And if they steal the server,
they've got enough time now to work on breaking that password anyway.
So, we often see physical access controls deployed through
something we call layered defense or defense in depth.
So even if a person gets through that first control,
there is still subsequent controls that could try to stop them
from getting to something of true value.
When we looked at logical access,
we looked at a number of things that we do to try and
control and protect our systems.
We protect not only the system itself,
but the networks that allow these systems to communicate
and the data that traverse these networks or are stored or
processed on these systems.
That meant we had to protect all of the elements of our
systems, that meant the endpoints we connect,
the ability to have remote access, the idea of wireless access,
and, of course,
we put in concepts like single sign‑on to try to reduce the
complexity for people trying to come onto our systems to
perform authorized functions.
We also looked at the value of having an access control policy,
and we very often would mandate that everyone had to follow that
policy whether or not that was based on a concept like discretionary
access control where a person could change the permissions and grant
access to somebody else or mandatory access control where things were
mandated by policy, and even if one person had access,
they couldn't grant that to anybody else.
We very often enforce rules, and these rules determine what a
person is allowed or not allowed to do.
But in order to make this simpler,
we often group people according to what their job responsibilities,
or we could say job roles are,
and everyone has identical or similar job roles
could be under the same rule set, and we call this role‑based access control,
very good in a situation where you've got a lot of turnover,
a lot of people with really similar responsibilities.
But we also know there is something else,
attribute‑based access control,
and attribute‑based access control tries to make sure that yes,
a person can have access,
but we could maybe limit that by another layer of control that says yeah,
but only during normal business hours.
So that time would be an attribute that we put on this,
should we say, access permission as well?
The next steps. Well, this is an important domain,
and understanding these concepts is really important, and
that means that we should review them.
Do I really understand them well?
Could I explain them to somebody else?
Not just memorize definitions, but memorize and
understand how to use those terms as well.
We can verify and validate our understanding by doing the sample questions
in the study guide and then proceed to the next domain,
Network Security for the Certified in Cybersecurity Certification.