Protecting Applications and Data: Managerial Controls and Access Controls
Introduced| English | Meaning |
|---|---|
| at rest/æt rest/ | Describing data stored on a device or medium rather than currently being transmitted. |
| in transit/ɪn ˈtrænsɪt/ | Describing data while it moves between devices, systems or locations. |
| in use/ɪn juːs/ | Describing data while it is actively being processed or handled by a system. |
| PII/ˌpiː aɪ ˈaɪ/ | PII |
| PHI/ˌpiː eɪtʃ ˈaɪ/ | PHI |
| PCI/ˌpiː siː ˈaɪ/ | PCI |
| RBAC/ˈɑːbæk/ | Access follows your role. |
| RuBAC/ruː bæk/ | Access follows a condition (like time). |
| DAC/ˌdiː eɪ ˈsiː/ | The owner decides. MAC : a central admin sets levels. |
| MAC/mæk/ | MAC |
| principle of least privilege/ˈprɪnsɪpl ɒv liːst ˈprɪvɪlɪdʒ/ | Giving each user or process only the access needed to carry out its authorised tasks. |
Data states and laws
- Data can be at rest 静态数据, in transit 传输中数据, or in use 使用中数据.
- Laws protect PII 个人身份信息, PHI 受保护健康信息, and PCI 支付卡信息.
- Sensitive data earns stronger controls.
Four access-control models
- RBAC 基于角色的访问控制: access follows your role.
- RuBAC 基于规则的访问控制: access follows a condition (like time).
- DAC 自主访问控制: the owner decides. MAC 强制访问控制: a central admin sets levels.
Four access-control models, by who decides access
Linux file permissions: read, write and execute for owner, group and others
Which access-control model fits the rule?
RBAC follows your role; RuBAC follows a condition; DAC lets the owner decide; MAC uses central levels.
"Allow access only during business hours" describes which model?
Difficulty 1/5 · 100 coins + a small bonus on first completion today
A condition (time) = RuBAC.
In ____ access control, the owner of a file decides who else may use it.
Difficulty 1/5 · 100 coins + a small bonus on first completion today
DAC = the owner decides.
Linux permissions
- Each file has read (4), write (2), execute (1) for owner, group, others.
chmod 640= owner read+write (6), group read (4), others none (0).- The principle of least privilege 最小权限原则 guides every model.
Tell the four access models apart by their decider, not their name. RBAC = your role, RuBAC = a condition, DAC = the file's owner, MAC = a central admin. Exam questions describe the rule and ask you to name the model.
What single number sets owner read+write, group read, others none? (chmod ___)
Difficulty 2/5 · 140 coins + a small bonus on first completion today
6 (4+2), 4, 0 → 640.
The principle of least privilege gives each user full access so work is never blocked.
Difficulty 1/5 · 100 coins + a small bonus on first completion today
False. Least privilege gives each entity exactly the access it needs and no more, limiting the damage if an account is compromised.
Match each access model to its decider.
Difficulty 2/5 · 140 coins + a small bonus on first completion today
Each model has a different decider.
To set report.txt so the owner can read and write, the group can only read, and others get nothing: read+write = 4+2 = 6, read = 4, none = 0. The command is chmod 640 report.txt.
Data is protected by its state and by law (PII/PHI/PCI). Access control uses four models — RBAC (role), RuBAC (condition), DAC (owner), MAC (admin levels) — all guided by least privilege. On Linux, permissions add read 4 + write 2 + execute 1 per group.