Cisco CyberOps Associate (CBROPS) 200-201Security ConceptsHard
A security auditor is reviewing an organization's access control policies. The auditor notes that standard users are granted read-only access to configuration files, while administrators have full read/write/execute permissions. However, a specific system configuration file, critical for network operations, is only accessible by a dedicated 'network_ops' service account, even for administrators. Which security principle is best exemplified by the access policy for the 'network_ops' service account?
- ALeast Privilege
- BImplicit Deny
- CSeparation of Duties
- DDefense in Depth
Show answer & explanationAnswer & explanation
Correct answer: A. Least Privilege
The 'network_ops' service account having exclusive access to a critical configuration file, even administrators cannot access it directly, exemplifies the Principle of Least Privilege. This principle dictates that users or processes should only be granted the minimum necessary permissions to perform their specific functions.
Why the other options are wrong
- B. Implicit Deny is a firewall rule that blocks all traffic not explicitly permitted, a policy, not a user access principle.
- C. Separation of Duties involves dividing critical tasks among multiple individuals to prevent a single point of control, focusing on human roles.
- D. Defense in Depth involves multiple layers of security controls, a broader strategy, not a specific access policy for an account.
Principle of Least Privilege (PoLP)
A security principle that requires every user, program, and process to be granted only the minimum set of permissions necessary to perform its specific task or function. This limits the potential damage from a compromise.
- Reduces the attack surface and potential blast radius of a breach.
- Applies to users, applications, services, and systems.
- A fundamental concept in access control and secure system design.
- Requires careful management of permissions and regular reviews.
Memory trick: Least Privilege Locks Down Access