A castle has more than a door
A castle has a moat, a wall, a gate, guards and a locked tower. If an enemy crosses the moat, the wall is still there. If the wall falls, the guards remain.
Good security is built the same way. Today you meet that idea, and three more words to use exactly.
Key words
| Word | What it means |
|---|---|
| Procedure | A set of steps to do a job the same way each time. |
| Requirement | Something a system must do or have. |
| Firewall | A control that allows or blocks traffic by rule. |
| RBAC | Role-based access control: rights come from a person's job. |
| Access control method | A way of allowing or refusing access to places or data. |
| Mandatory access control | The system sets the rules from security labels. Users cannot change them. Short form: MAC. |
| Discretionary access control | The owner of a file or resource decides who may use it. Short form: DAC. |
| Defence in depth | Layers of security, so protection remains if one layer fails or is bypassed. |
| Reliability | A system or part works under set conditions for a set length of time. |
| Assurance | Checking the security requirements of systems, policies and procedures, to confirm they have been met. |
| Security label | A tag on data, such as secret or public, that the system uses to decide access. |
| Bypass | Going round a control. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can describe access control methods, defence in depth, reliability and assurance, and use each word correctly.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Access control methods
An access control method allows or refuses access to places or data. Three are common.
Mandatory (MAC): the system decides, using security labels. Users cannot change the rules. It is used where secrecy matters most, such as government.
Discretionary (DAC): the owner of a file decides who may use it.
Role-based (RBAC): rights follow the person's job.
Extra: See an owner and file rights
stat -c "%A %U %G %n" /etc/passwdA command for the lesson’s lab terminal. It is shown here and not run.
Read the output
The first part, -rw-r--r--, shows the rights. The next two words are the owner and the group. On a Linux server, the owner of a file can change its rights. That is discretionary control.
On a server that uses MAC, the owner could not.
Check: access control methods
Have a go
Check: access control methods
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.