cisco certification kenya

cisco certification kenya. needtoknow (needtoknow): the access rights granted to a subject can only match the work it is accomplishing. Permissions maycan be abstract, e.g., "open this door", or it can be more formal, e.g., read, write, or execute a particular resource.4.4.4 Bookkeeping Bookkeeping is the process of auditing and monitoring the actions performed by users after they have gained access to a particular resource. This process is sometimes overlooked; however, as a security professional, it is critical to understand bookkeeping and advocate its implementation, as bookkeeping can be very useful in detecting and investigating network security vulnerabilities. When bookkeeping is implemented, an audit trail log is created and stored, which details when a user accesses a resource, the actions the user performs on the resource, and when the user stops using the resource. Since what is recorded in the audit logs may be sensitive information, these logs are protected from access by unauthorized users.4.4.5 Access Control Basics: Summary The 4-step process described in this section will be summarized below by way of an example, using the example of a user withdrawing money from an automated teller machine (ATM). Step 1. When the user contacts the machine to insert a bank card, he or she is identifying himself or herself to the system. Once the user is identified, the system confirms the user's identity and typically asks the user to enter a PIN code. This step performs authentication, and is performed by knowledge authentication (the user enters the PIN) plus ownership authentication (the user inserts his or her bank card). Step 3. Once authenticated, the user can withdraw funds from their account. However, the user can withdraw up to a maximum of $500. This is controlled by the authorization process, and the user is not authorized to engage in transactions with a withdrawal limit of more than $500.186 Chapter 4 Introduction to Access ControlStep 4. After a user withdraws money, the ATM system records information related to the transaction, including user information, ATM location and identification number, user account number, withdrawal amount, and withdrawal date and time. Table 4-3 summarizes the four phases of the access control process and gives examples of each.Table 4-3 4 Stages of the Access Control ProcessBrick PointPhase Questions to be answered by the subject ExampleIdentification Who are you User ID, IP address