6. Physical Attacks: Physical tampering or unauthorized access to hardware, systems, or infrastructure, such as stealing devices, tapping into network cables, or infiltrating data centers.
7. Man-in-the-Middle (MitM): Attacks where an attacker intercepts and alters communication between two parties without their knowledge. This allows the attacker to eavesdrop, modify, or steal information.
8. IoT Vulnerabilities: Internet of Things devices often lack robust security measures, making them susceptible to attacks. Vulnerabilities in IoT devices can lead to unauthorized access, data breaches, or control manipulation.
9. Insider Threats: Attacks or security breaches caused by individuals within an organization who have authorized access but misuse it for personal gain, sabotage, or negligence.
10. Advanced Persistent Threat (APT): Sophisticated, long-term cyber attacks carried out by skilled adversaries who stealthily penetrate a target's network to extract sensitive information or maintain persistent access.
It's important to stay aware of these common threats and vulnerabilities to implement appropriate security measures, such as robust antivirus software, regular updates, user awareness training, access controls, encryption, intrusion detection systems, and monitoring to mitigate risks and protect systems and data.
1.3. Explain access management principles
1. Access Management Principles:
Authentication: The process of verifying the identity of a user or entity requesting access to a system or resource. Authentication ensures that only authorized individuals or entities gain access.
Common authentication methods include passwords, PINs, biometrics (fingerprint, facial recognition), smart cards, and certificates.
Strong authentication practices involve using multiple factors (multifactor authentication) to enhance security.
Authorization: The process of granting or denying specific privileges, permissions, or access rights to authenticated users based on their role, responsibilities, or attributes.
Authorization mechanisms ensure that authenticated users have appropriate access privileges and restrictions.
Access control lists (ACLs), role-based access control (RBAC), and attribute-based access control (ABAC)
are common authorization techniques.
Accounting (or Auditing): The process of tracking and monitoring user activities, including logins, access attempts, system actions, and resource usage.
Accounting helps in identifying security incidents, monitoring compliance, and generating audit trails for forensic investigations.
2. AAA (Authentication, Authorization, and Accounting): AAA is a framework that combines these three principles to manage and control access to network resources.
Authentication verifies the user's identity.
Authorization determines what the authenticated user is allowed to do.
Accounting tracks and logs the user's activities for auditing purposes.
3. RADIUS (Remote Authentication Dial-In User Service): A protocol commonly used for centralized authentication, authorization, and accounting for remote access services.
4. Multifactor Authentication (MFA): An authentication method that requires users to provide multiple pieces of evidence to prove their identity. It adds an extra layer of security beyond just a password.
MFA typically combines something the user knows (password), something the user has (smart card, token), and something the user is (biometric).
5. Password Policies: Guidelines and rules governing the creation, usage, and management of passwords to enhance security.
Password policies may include requirements for password length, complexity, expiration, and restrictions on password reuse.
Enforcing strong password policies helps protect against unauthorized access through password cracking or guessing.
Implementing proper access management principles ensures that only authorized individuals or entities can access resources, reducing the risk of unauthorized access, data breaches, and insider threats. It helps maintain the confidentiality, integrity, and availability of systems and data.
