CISSP Training Kit

Chapter summary

• Subjects (active) use computers and programs to access (information flow) objects (passive repository of data). A trusted path must be established between the subject and the object.

• Access controls are technical controls, administrative controls, or physical controls. Controls are driven by threats and are implemented to deter, delay, prevent, detect, assess, respond (correct, recover), compensate, or direct.

• Controls of various types should be implemented in layers. Remember: Defense in depth.

• AAA = authentication (something you know, something you have, and something you are), authorization, and accounting. (The third A is also auditing or accountability.)

• Attacks on authentication include the brute force, the dictionary, the hybrid, ...