![]() ![]() Authorization – determines what an subject can do.Authentication – determines whether a subject can log in. ![]() They do not manipulate other objects.Īccess control systems provide three essential services: The important thing remember about objects is that they are passive within the system. Objects can range from databases to text files. A Dynamic Link Library file or a Perl script that updates database files with new information is also a subject.Īn object is any passive data within the system. However, running computer programs are subjects as well. Most examples of subjects involve people accessing data files. Basic concepts of access controlĬIA triad and his opposite ( DAD) – see (My) CISSP Notes – Information Security Governance and Risk ManagementĪ subject is an active entity on a data system. Access control protect against threats such as unauthorized access, inappropriate modification of data, loss of confidentiality. Access control is performed by implementing strong technical, physical and administrative measures. The purpose of access control is to allow authorized users access to appropriate data and deny access to unauthorized users and the mission and purpose of access control is to protect the confidentiality, integrity, and availability of data. Note: This notes were made using the following books: “CISPP Study Guide” and “CISSP for dummies”. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |