5.2 Protecting Applications and Data: Managerial Controls and Access Controls（保护应用与数据：管理控制与访问控制）

LO 4 · EK 21 ｜ 严格按大纲顺序学习

▶ 从第一个 EK 开始看课件（幻灯片，可翻页/全屏） 点击下方任意 EK 编号（如 5.2.A.1）也可直接进入对应课件页

学习目标 Learning Objectives

5.2.A Explain how the state or classification of data impacts the type and degree of security applied to that data. Bullet Personally identifiable information (PII) is any data that allows someone to be identified and includes (but is not limited to): name, signature, phone number, address, biometric data (e.g., fingerprints), social security number, date of birth, and email address. The protection of this data is covered by many laws but most notably The Privacy Act of 1974 and for children under the age of 13 the Children’s Online Privacy Protection Act of 1998. Bullet Protected health information (PHI) is any data related to an individual’s health, treatment, payment for healthcare at any time and includes (but is not limited to): test results, treatment records, hospital records, doctor visit notes, and health provider payment records. The protection of PHI is included in the Health Insurance Portability and Accountability Act of 1996. Bullet Payment card information (PCI) is the data collected by organizations to process payments via cards (e.g., credit cards) and includes the following: name, account number, expiration date, address, and CVV code. The protection of this data is regulated by the Payment Card Industry Data Security Standard (PCI-DSS).

- [5.2.A.1](/ek/5.2.A.1) — Organizations implement specific security controls to comply with legal requirements based on th… - [5.2.A.2](/ek/5.2.A.2) — Data can be classified by their state. Bullet Data at rest are stored on a drive. It is importan… - [5.2.A.3](/ek/5.2.A.3) — Organizations often categorize data according to their sensitivity and prioritize a higher degre… - [5.2.A.4](/ek/5.2.A.4) — Laws and regulations can require certain types of data to be stored, transmitted, and handled ac… - [5.2.A.5](/ek/5.2.A.5) — Organizations that collect regulated data will label them and have policies that comply with the…

5.2.B Identify managerial controls related to application and data security.

- [5.2.B.1](/ek/5.2.B.1) — A cryptography policy will describe the acceptable encryption protocols and key parameters for a… - [5.2.B.2](/ek/5.2.B.2) — A web application security policy will outline the requirements and parameters for testing and m…

5.2.C Determine an appropriate access control model to protect applications and data.

- [5.2.C.1](/ek/5.2.C.1) — Access control enforces which users or applications (called subjects) can access, modify, add, o… - [5.2.C.2](/ek/5.2.C.2) — Role-based access control (RBAC) assigns every subject to a role and defines which roles have wh… - [5.2.C.3](/ek/5.2.C.3) — Rule-based access control (RuBAC) checks a set of rules to determine what type of access a subje… - [5.2.C.4](/ek/5.2.C.4) — Discretionary access control (DAC) gives individual subjects the ability to set the type of acce… - [5.2.C.5](/ek/5.2.C.5) — Mandatory access control (MAC) follows strict rules for which types of access each subject level… - [5.2.C.6](/ek/5.2.C.6) — The Bell-LaPadula model is a MAC model that is often used by governments and military organizati… - [5.2.C.7](/ek/5.2.C.7) — The principle of least privilege is the idea that entities should be given exactly as much acces…

5.2.D Configure access control settings on a Linux-based system. Therefore 3 sets permission to write and execute, 5 sets permission to read and execute, 6 sets permission to read and write, and 7 sets permission to read, write, and execute. ILLUSTRATIVE EXAMPLES Bullet The command chmod 750 test would set the permissions for the owner to read, write, and execute, for the group to read and execute, and for everyone else to no access at all. Bullet The command chmod 543 test would set the permissions for the owner to read and execute, for the group to read only, and for everyone else to write and execute. Bullet The command chmod 777 test would set the permissions for all three entities to read, write, and execute for the file test.

- [5.2.D.1](/ek/5.2.D.1) — Authorization is when an entity is granted permission to have a certain type of access to a reso… - [5.2.D.2](/ek/5.2.D.2) — There are three types of access to a file in Linux that can be set, and they always come in the … - [5.2.D.3](/ek/5.2.D.3) — There are three default entities for which permissions are set and always in this order: (1) the… - [5.2.D.4](/ek/5.2.D.4) — To view the current permission settings for a file, use the command ls -l , which will show the … - [5.2.D.5](/ek/5.2.D.5) — To modify the permission settings for a file, use the chmod command. This command can be used wi… - [5.2.D.6](/ek/5.2.D.6) — To use chmod in the numeric method the syntax is chmod ### filename. Each of the three ### repre… - [5.2.D.7](/ek/5.2.D.7) — To use chmod in the symbolic method the syntax is chmod entity +(or –) permission filename. The …

---

← 返回单元 Unit 5