ISC2 Certified in Cybersecurity (CC)Access Controls ConceptsMedium
A security analyst is investigating a potential insider threat where an employee is suspected of accessing sensitive project files unrelated to their current role. The company's access control system logs every attempt to access files, successful or not, along with the user's identity and timestamp. Which access control concept is most crucial for identifying and investigating this activity?
- AAccountability
- BAuthentication
- CAuthorization
- DIdentification
Show answer & explanationAnswer & explanation
Correct answer: A. Accountability
Accountability ensures that actions of an entity can be traced uniquely to that entity. The scenario describes logging all access attempts with user identity and timestamps, which is the foundation for establishing accountability and tracing actions to the suspected employee.
Why the other options are wrong
- B. Authentication is proving who a user is (e.g., password).
- C. Authorization determines what an authenticated user is permitted to do, but doesn't track actions.
- D. Identification is asserting who a user is, often a username.
Accountability (Access Control)
The principle that ensures that all actions performed on a system can be attributed to a specific individual or entity.
- Relies on strong identification and authentication.
- Enabled by comprehensive logging and auditing.
- Essential for forensics and incident response.
Memory trick: AAA: Assert, Prove, Permit, Trace.