Instructor

CISSP, CCSP, CISA, JNCIP-Sec

Objectives 3.1
Understand logical access controls
• Definition: Users and systems are granted only the
minimum access necessary to perform their tasks, reducing
security risks.
• Purpose: Limits potential damage from accidental or
malicious actions by restricting unnecessary privileges.
• Implementation: Assign permissions based on roles,
regularly review access rights, and enforce strict access
controls.
• Benefits:
• Reduces security risks from compromised accounts.
• Limits potential damage from insider threats.
• Simplifies auditing and compliance.
• Improves overall system stability.
• Definition: Dividing critical tasks among multiple users to
prevent fraud, errors, and unauthorized actions.
• Purpose: Ensures no single individual has complete control
over sensitive operations, reducing insider threats.
• Implementation: Divide responsibilities (e.g., request,
approval, and execution) and enforce access controls to
limit overlapping privileges.
• Benefits: Enhances accountability, deters insider threats,
and strengthens overall security.
Financial Transactions: In a financial system, SoD ensures
that no single person can both initiate and approve a
payment:
• Purchasing: One employee is responsible for creating
and submitting purchase orders.
• Payment Processing: A separate employee is
responsible for approving those purchase orders and
issuing payments.
• Record Keeping: A third employee, or system,
reconciles the bank statements, and records the
transactions.
• Definition: A flexible access control model where
the owner of a resource determines who can
access it and what actions they can perform.
• Key Feature: Permissions are assigned at the
discretion of the data owner rather than enforced
by a central authority.
• Advantage: Flexible and user-friendly.
• Drawback: Less secure, as owners may grant
excessive access, increasing risk of misuse.
• Example: A file owner granting or restricting
read/write access to specific users in an operating
system.
• Definition: A strict access control model where
permissions are enforced by a central authority based
on security classifications.
• Key Feature: Users cannot change access permissions;
access is determined by system policies and security
labels.
• Advantage: Highly secure, minimizes risk of
unauthorized access.
• Drawback: Inflexible and complex to manage.
• Example: A military system where documents are
classified as Confidential, Secret, or Top Secret, and only
users with the appropriate clearance can access them.
• Definition: A security model where access permissions
are assigned based on a user's role within an
organization.
• Key Feature: Users inherit permissions based on
predefined roles (e.g., Admin, Manager, Employee),
simplifying access management.
• Advantage: Simplifies management, improves scalability,
and ensures consistent access rights.
• Drawback: Requires careful role design to avoid
excessive permissions.
• Example: In a company, an HR manager can access
employee records, while an IT staff member can
manage system configurations.
Objectives 3.2
Understand physical access controls
• Definition: Physical security is the protection of physical
assets, including hardware, data centers, and
personnel, from unauthorized access.
• Importance: Strong physical security is crucial for
information security as it prevents unauthorized access
to sensitive data and infrastructure.
Key Components:
• Access Control: Implementing measures to restrict access
to authorized personnel only, such as: Biometric
authentication (fingerprint, facial recognition, iris scan),
Access cards or tokens and Security guards
• Perimeter Security: Protecting the physical boundaries of
the facility, such as: Fences and barriers, Surveillance
cameras and Alarm systems
• Environmental Controls: Maintaining optimal
environmental conditions for hardware and data,
including: Climate control, Fire suppression systems,
Power backup solutions
• Identification and Authentication: Access badges verify the
identity of individuals entering secured areas, ensuring only
authorized personnel are admitted.
• Access Restriction: Configurable to allow entry to specific
zones based on roles and permissions, enhancing security.
• Tracking and Auditing: Records badge usage, providing logs
for monitoring and incident investigation.
• Multi-factor Integration: Can integrate with PINs or
biometrics for enhanced security.
• Deterrence: Acts as a visible reminder of security protocols,
discouraging unauthorized access.
• Lost or Stolen Badge Management: Easily deactivated to
prevent misuse if a badge is lost or stolen
• Definition: Bollards are sturdy, vertical posts
installed to block vehicles or unauthorized
personnel from accessing restricted areas.
• Purpose: They prevent physical breaches, such as
ramming attacks, which could lead to data theft
or damage to critical infrastructure.
• Examples of Use: Protecting server rooms, data
centers, and outdoor IT equipment like backup
generators or telecom cabinets.
• Material: Typically made of steel or reinforced
concrete for durability and impact resistance.
• Integration: Often used alongside access control
systems like gates or barriers for comprehensive
perimeter security.
• Definition: Fences are barriers designed to prevent
unauthorized physical access to a specific area, typically
around facilities, data centers, or restricted zones.
• Purpose: They serve as the first line of defense by
creating a clear boundary between secure and public
areas.
• Deterrent: Visible fences discourage intrusions and
signal that the area is protected.
• Types: Fences can vary based on security needs,
including chain-link, barbed wire, or electric fences.
• Integration: Often paired with additional security
measures like surveillance cameras, motion sensors,
and security personnel for enhanced protection.
Objectives 3.2
Physical Security Monitoring systems
• Cameras and video surveillance provide a way to
monitor and record the property perimeter for
intruders and potential attackers
• They are considered detective physical controls,
but the mere presence may also be a deterrent
• Security guards are typically employed
24x7, but could just be present during
business or non-business hours.
• They fit into multiple security control
types:
• Detective
• Deterrent
• Preventative
• They can provide rapid security response
if an intrusion or incident occurs
• Robot sentries are rapidly replacing
humans in certain scenarios
• Deterrence: Well-lit areas discourage unauthorized access and
criminal activities by increasing the risk of detection.
• Visibility: Enhances visibility for security personnel, CCTV cameras,
and authorized users to monitor and detect suspicious activities
effectively.
• Access Control: Illuminates entry points such as doors, gates, and
parking areas to improve monitoring and control of access.
• Safety: Reduces accidents and hazards for authorized personnel by
improving navigation in dark areas.
• Strategic Placement: Critical in high-risk zones, such as perimeters,
pathways, and critical infrastructure areas, to enhance overall
security.
• Integration with Technology: Works in conjunction with motion
sensors, CCTV, and alarm systems for automated threat detection and
response.
• Infrared: Detects heat signatures in the form of infrared
radiation emitted by people, animals, or objects.
• Integrated into security cameras and alarm systems to
improve detection capabilities.
• Pressure: designed to detect changes in pressure on a surface or
in a specific area, such as a person walking on a floor or
stepping on a mat.
• Used in access control systems to ensure that only
authorized individuals can enter
• Microwave: uses microwave technology to detect movement
within a specific area.
• often used with other types of sensors to reduce false
alarms
• Ultrasonic: emits high-frequency sound waves and measure the
time it takes for the sound waves to bounce back after hitting an
object or surface.
• commonly used in parking assistance, robotic navigation,
and intrusion detection