Authorization and Access Controls
Goals
- Define authorization
- Define the principle of least privilege
- Define access control
- Identify access control list types (e.g., file system and network)
- Define the confused deputy problem and its common uses, including cross-site request forgery (CSRF) and clickjacking
- Define capability-based security
- Compare access control models
- Differentiate between authorization and access control
- Identify cybersecurity concepts and principles that protect critical information (e.g., intellectual property, files)
After receiving a subject’s claim of identity and established whether that claim is valid, you then have to decide whether to allow a party access to resources.
- achieved by authorization and access controls