Controls, authentication and authorization

ISC Chapter 13 · Area II · Blueprint II.B.2

Every attack in chapter 11 eventually meets a control, and most controls come down to two questions: who are you, and what are you allowed to do? This chapter answers both. Priya helps Brightwater choose preventive, detective and corrective controls for real scenarios, pick the right way to prove identity (passwords, PINs, multi-factor authentication, single sign-on, smart cards, digital signatures, biometrics), and choose an authorization model (discretionary, role-based or mandatory) with the access lists, account restrictions and physical barriers that make it work. The exam asks you to choose the right control for a scenario, so the chapter is built around scenarios.

In this chapter

Preventive, detective and corrective controls
Choosing controls for a cyber risk
Proving identity: passwords, PINs and multi-factor authentication
Single sign-on, digital signatures, smart cards and biometrics
Authorization models: discretionary, role-based and mandatory
Implementing authorization: ACLs, restrictions and physical barriers

This chapter has 6 lessons, 50 practice MCQs with explanations and 20 simulations, plus flashcards and a recall sheet.

What this chapter covers

Preventive, detective and corrective controls
passwords, MFA, single sign-on and biometrics
discretionary, role-based and mandatory access

Chapter 12: Protecting networks and systems · Chapter 14: Testing security controls