Summary of Exam Objectives

This chapter has covered many different aspects of access control and delved deeply into the various types, methods, models, and parts of access control. It started by going over some basic definitions of access control such as access control objects, subjects, and systems. From there, it moved on to the purposes, intents, and objectives of access control. This includes the process of obtaining access through authentication, identification, and authorization. This chapter also covered the assurance aspect of access control and touched on the assurance subjects of confidentiality, integrity, availability, and accountability.

From there it covered the various types of authentication. The "something you know," "something you have," and "something you are" authentication types and combinations thereof comprise the basic foundation of authentication. It also touched on authentication within the enterprise including SSO technology with Kerberos and X.509. Remote access authentication in the forms of TACACS and RADIUS were also covered.

Password administration was the next subject. It went over the most important aspects of password administration including selection, management, and auditing. For each of these parts of password administration, some industry best practices and policies were covered.

This led into the next section, which covered the three major types of access control policies: preventive, corrective, and detective. This chapter discusses the various types of access control policy implementations, which are administrative, logical/technical, and physical. This chapter also went over both the centralized and decentralized methodologies and discussed how they work and their advantages and disadvantages.

Access control models were then discussed in great detail. This section covered the basis of access control models in general, including the "Orange" book and "Red" book guidelines. It discussed DAC, MAC, non-discretionary, or role-based access control (RBAC), as well as the formal models of Bell-LaPadula, Biba, and Clark-Wilson. It went over the basic definition of each of these models as well as how they are typically implemented and how they work.

The next subject was the administration aspect of access control. This section discussed the ongoing maintenance activities required for access control systems to work. It covered the areas of account administration, rights and permissions determination, management of access control objects, monitoring, securing removable media, and management of data caches. Each of these is an important part of access control administration and is a knowledge requirement of the SSCP exam.

Methods of attack were covered in the next section. It went over the various types of password attacks including dictionary and brute force cracking. It then went over DoS and DDoS attacks. Spoofing and its counterpart, MITM attacks, were covered next, discussing how this attack is performed and what its implications are. Finally, it covered the intentional or unintentional spam attack and discussed how sniffers work.

Monitoring was the next subject. This section went over automated and manual types of monitoring including IDSs and NIDSs. It also covered alarms and how they should be configured, as well as audit trails and violation reports.

Penetration testing was the final subject discussed. This section covered the timing and best practices for this testing method. It also went over the methodology of penetration testing and touched on weakness identification and what to do with the results of a penetration test.



SSCP Systems Security Certified Practitioner Study Guide
SSCP Study Guide and DVD Training System
ISBN: 1931836809
EAN: 2147483647
Year: 2003
Pages: 135

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net