QuestionQ31

Information Security Threats and Attacks

Within a multinational corporation, the IT department deployed a new network security protocol for its global data centers. The protocol was intended to strengthen security by incorporating advanced access-control principles. It uses a combination of methods to ensure that only authorized personnel can access sensitive data.

Recently, an unauthorized user accessed confidential data. The security team found that the intruder had exploited a particular aspect of the access-control principles, terminologies, and models. Which aspect was most likely exploited?

  • A Role-Based Access Control (RBAC), where access is given based on the roles within the organization.
  • B Discretionary Access Control (DAC), where the resource owner decides on the access permissions.
  • C Attribute-Based Access Control (ABAC), where access decisions are made based on a set of policies and attributes.
  • D Mandatory Access Control (MAC), where access decisions are made based on predefined rules set by the system’s administrator.
Explanation

Discretionary Access Control (DAC) permits the owner of a resource to determine its access permissions. If those owner-managed permissions are overly broad, incorrectly assigned, or changed by a compromised owner account, an unauthorized user can obtain access to confidential data.

Community Discussion

No comments yet. Be the first to start the discussion!