ISC2 CISSP (Certified Information Systems Security Professional)Asset SecurityMedium
A government agency is implementing a new system to store classified documents. The system design includes mandatory access control (MAC) mechanisms where access decisions are based on the sensitivity labels of the documents and the clearance levels of the users. Which of the following is the MOST relevant concept being applied here?
- ANeed-to-know Principle
- BRole-Based Access Control (RBAC)
- CInformation Classification
- DDiscretionary Access Control (DAC)
Show answer & explanationAnswer & explanation
Correct answer: C. Information Classification
The scenario explicitly mentions 'sensitivity labels of the documents' and 'clearance levels of the users,' which are fundamental components of information classification. While MAC and need-to-know are applied, the underlying requirement for such controls to function is a robust information classification scheme.
Why the other options are wrong
- A. Need-to-know is a principle, but classification defines what that 'need' is based on sensitivity.
- B. RBAC grants access based on roles, not directly on sensitivity labels and clearance levels.
- D. DAC allows data owners to define access, which is contrary to the strict nature implied by classified documents.
Information Classification
The process of categorizing information based on its sensitivity, value, and criticality to an organization, often determining its protection requirements.
- Assigns sensitivity labels (e.g., Top Secret, Confidential).
- Prerequisite for Mandatory Access Control (MAC).
- Helps determine appropriate security controls.
Memory trick: Classify to Control, Label to Govern All.