types of access control.
1. Detective access control are normally used to discover (and document) unwanted or
unauthorized activity.
2. Preventive access control block the ability to perform unwanted activity.
3. Deterrent access control attempt to persuade the perpetrator not to perform
unwanted activity.
4. Corrective Access control restore a system to normal function in the event of a failure
or system interruption.
Hardware network device operates in Network layer (Layer 3).
stateful inspection firewall (also known as dynamic packet-filtering firewall which
enables real-time modification of the filtering rules based on traffic content and context,
while the rest of the firewall are stateless and thus do not consider the context for
dynamic filtering.
CIA Triad: availability, confidentiality, integrity.
AAA Services or (IAAA): Identification, authentication (i.e., identification verification),
authorization (i.e., access control). auditing (i.e., logging and monitoring), and
Accounting.
Data owner: must first assign a security label to a resource before giving to data
custodian.
Data custodian: must get from data owner with security label before they can secure
the resources appropriately.
Senior Management: responsible for the success or failure of a security endeavor.
Auditor: responsible for reviewing and verifying that the security policy is properly
implemented and users are in compliance with the security policy.
SW-CMM: The (level 4) Managed phase involves the use of quantitative development
metrics, while the Software engineering institute (SEI) defines the key process areas for
this level as Quantitative process management and software quality management.
While the Repeatable phase (Level2) is where basic lifecycle processes are
introduced, The Defined Phase (level 3) is where developers operate according to a
set of formal, documented development processes. The operating phase (level 5) is
where a process of continuous improvement is achieved.
FIN Flagged Packet is not used in TCP Three-way handshake to establish a session, it
is used in the session tear-down process.