Got it 👍 — you want complete notes on Access Controls for the (ISC)² Certified in Cybersecurity (CC)
exam.
This falls mainly under Domain 3: Access Controls Concepts. I’ll prepare you detailed, structured notes
covering all the areas ISC2 expects.
---
📘 Certified in Cybersecurity (CC) – Domain 3: Access Control Concepts
---
1. Introduction to Access Control
Access Control: The process of managing who (subject) can access what (object), and under which
conditions.
Goal: Protect confidentiality, integrity, and availability (CIA).
Subject = Active entity (user, process, service).
Object = Passive entity (file, database, system resource).
Access control ensures least privilege: subjects only get the minimum rights required to perform tasks.
---
2. Types of Access Controls
A. Logical/Technical Controls
Implemented through technology:
Passwords, PINs, biometrics
Smart cards, tokens, MFA
Firewalls, IDS/IPS
Access Control Lists (ACLs)
B. Physical Controls
Protect the physical environment:
Security guards
Locks, key cards
CCTV, fences, gates
Mantraps, turnstiles
C. Administrative/Managerial Controls
Policies, procedures, and governance:
Security policies
User training & awareness
Background checks
Separation of duties
---
3. Access Control Practices
Authentication
Verifying a subject’s identity.
Something you know: Password, PIN, passphrase
Something you have: Smart card, token
Something you are: Biometrics (fingerprint, iris, voice)
Somewhere you are: Location-based (IP, GPS)
Something you do: Typing rhythm, gait recognition
👉 Multi-Factor Authentication (MFA) = two or more different factors.
Authorization
Determining what a subject can do after authentication.
Based on role, policy, or rules.
Examples: file permissions, system roles.
Accounting (Auditing)
Tracking user activities for non-repudiation and compliance.
Logging login attempts, file access, admin actions.
---
4. Identity and Access Management (IAM)
IAM lifecycle involves:
1. Provisioning – creating user accounts.
2. Authentication – verifying identity.
3. Authorization – assigning privileges.
4. Review/Monitoring – auditing access, checking for misuse.
5. De-provisioning – disabling/removing accounts.
👉 Key Principle: Least Privilege and Need-to-Know.
---
5. Access Control Models
1. Discretionary Access Control (DAC)
Owner of the resource decides access rights.
Example: Windows file sharing (user sets read/write).
Weakness: prone to privilege escalation.
2. Mandatory Access Control (MAC)
Central authority assigns access, based on labels (e.g., Secret, Top Secret).
Used in military/government.
User cannot change permissions.
3. Role-Based Access Control (RBAC)
Access depends on role (e.g., HR, Finance, Admin).
Scales well for enterprises.
Example: HR role → can access payroll but not engineering docs.
4. Rule-Based Access Control
Access controlled by rules (firewall ACLs, conditions, time-of-day).
Example: Only allow access during business hours.
5. Attribute-Based Access Control (ABAC)
Based on attributes of subject, object, and environment.
Example: User role = Manager, Location = Office, Time = Work hours.
---
6. Privileged Accounts
Administrator / Root Accounts – high-level privileges.
Risks: Insider misuse, credential theft.
Controls:
Privileged Access Management (PAM) tools
Logging & monitoring
Separation of duties
Just-in-time privilege
---
7. Zero Trust Access
Modern model: “Never trust, always verify.”
Continuous verification (not just at login).
Enforces least privilege, contextual authentication (device, location, behavior).
Widely used in cloud and hybrid environments.
---
8. Access Control Threats & Attacks
Brute force attacks (guessing passwords).
Phishing / social engineering (stealing credentials).
Privilege escalation (gaining higher rights).
Session hijacking (stealing tokens/cookies).
Weak authentication (single-factor).
👉 Defenses: MFA, account lockouts, monitoring, strong password policies.
---
9. Access Control Policies
Separation of Duties (SoD): No single person should control all critical functions.
Need-to-Know: Users only get access if they require it.
Least Privilege: Grant minimum permissions needed.
Job Rotation: Prevent fraud, detect misuse.
Mandatory Vacation: Forces absence to reveal hidden issues.
---
10. Summary for Exam
Understand authentication, authorization, and accounting (AAA).
Differentiate access control types: logical, physical, administrative.
Learn the IAM lifecycle.
Compare DAC, MAC, RBAC, Rule-based, ABAC.
Remember least privilege, need-to-know, separation of duties.
Recognize MFA factors.
Be aware of privileged account risks and zero trust.
---
✅ With these notes, you’re fully covered for Access Control questions in the CC exam.
Do you want me to also create a 50-question mock exam (Domain 3: Access Controls) to practice and
reinforce these concepts?
Core Access Control Principles
These are the fundamental philosophies behind all access control systems.
Principle of Least Privilege (PoLP)
What it is: A user or process should only have the minimum levels of access (permissions) absolutely
necessary to perform its intended function.
Why it's critical: It dramatically reduces the attack surface. If an account is compromised, the attacker
has limited access. It also reduces the potential for accidental damage by users.
Example: A user in the accounting department doesn't need install software on their machine. Their
account should not have local administrator rights.
Segregation of Duties (SoD) / Separation of Duties
What it is: Critical tasks are split among multiple users to prevent fraud, error, and abuse. No single
individual should have complete control over a process from start to finish.
Why it's critical: It is a key internal control against fraud. It requires collusion to bypass, which is harder
and riskier for a malicious actor.
Example: The person who requests a payment to a vendor cannot be the same person who approves the
payment. The person who writes the code cannot be the sole person who deploys it to production.
Two-Person Rule (Two-Person Control)
What it is: A specific, stricter form of SoD. It requires the simultaneous approval of two authorized
individuals to perform a single, highly sensitive action.
Why it's critical: Used for actions where the risk is exceptionally high (e.g., launching a weapon,
accessing a root certificate key, transferring millions of dollars).
Example: To open the bank's primary vault, two managers must insert their keys and turn them at the
same time.
Authentication Factors (Memorized Secrets)
You correctly identified "Something You Know." This is one of three main factors of authentication. You
must know all three for the exam.
Type 1: Something You Know (Knowledge Factor)
Examples: Passwords, PINs, Passphrases, answers to security questions.
Memorized Secret is the modern NIST term for a password/PIN.
Type 2: Something You Have (Possession Factor)
Examples: Smart card, hardware token (e.g., YubiKey), software token (Google Authenticator, Duo), a
badge.
Type 3: Something You Are (Inherence Factor)
Examples: Fingerprint, retina/iris scan, facial recognition, voiceprint.
Somewhere You Are (Location Factor) - Sometimes considered a fourth factor.
Example: Only allowing access if the connection originates from a specific country or IP range.
Something You Do (Behavioral Factor) - Another potential factor.
Example: Keystroke dynamics, mouse movement patterns.
Multifactor Authentication (MFA) requires a user to present evidence from two or more different
factors. Using a password (something you know) and a PIN from an authenticator app (something you
have) is MFA. Using a password and a security question (both something you know) is not MFA; it's
single-factor.
IAAA (The Four Pillars of Access)
Often recalled as "I Triple-A."
Identification: Claiming an identity. This is the username, user ID, or email address you type in. ("I am
user123").
Authentication: Proving that identity. This is where you provide the password, fingerprint, or token to
prove you are indeed user123.
Authorization: Determining what an authenticated identity is allowed to do. ("user123 is authorized to
read this file but not delete it").
Accounting (Auditing): Logging and tracking access and actions. Recording what user123 did, when they
did it, and what they accessed. Crucial for forensics and compliance.
IAM and PAM
IAM (Identity and Access Management): The broad framework of policies and technologies for ensuring
the right individuals have the right access to the right resources at the right times. It covers the entire
identity lifecycle (see below).
PAM (Privileged Access Management): A subset of IAM focused specifically on superuser or
administrative accounts (privileged accounts). These accounts have elevated permissions and are high-
value targets.
Examples of PAM tools: CyberArk, BeyondTrust, Thycotic.
PAM Practices: Just-in-Time access, vaulting passwords, session monitoring, and rotation of credentials
for these powerful accounts.
Identity Management Lifecycle (Provisioning Cycle)
This is the process of managing a user's identity from start to finish. Know these five stages:
Provisioning: Creating the user account and granting them initial access to resources needed for their
job role (onboarding).
Review: Periodically checking (auditing) user access rights to ensure they are still appropriate. This is
often part of a user access review (UAR) for compliance.
Privilege Changes: Modifying access. This could be escalation (granting more access, e.g., for a special
project) or de-escalation (removing access, e.g., during a investigation).
Deprovisioning: Removing all access when a user leaves the organization or changes roles (offboarding).
This is critical for security.
Security Controls: Function and Type
You need to know how to classify a control by its function and its type.
By Function (What it DOES):
Preventive: Stops an incident from occurring. (e.g., Firewall, door lock, mandatory access control).
Detective: Identifies and logs an incident that is in progress or has occurred. (e.g., CCTV, IDS, antivirus
scanning).
Corrective: Mitigates damage or restores systems after an incident. (e.g., Restoring from backup,
patching a system).
Deterrent: Discourages a potential attacker. (e.g., "Beware of Dog" sign, warning banners on login
screens).
Compensating: Provides an alternative control when the primary one is not possible. (e.g., Using video
surveillance (detective) to compensate for a broken door lock (preventive)).
Physical: Tangible, real-world controls. (e.g., Fences, guards, mantraps).
By Type (What it IS):
Administrative: Policies, procedures, and guidelines. (e.g., Security training, hiring policies, security
plans).
Technical (Logical): Technology-based controls. (e.g., Firewalls, encryption, access control lists).
Physical: (Same as above) Tangible, real-world controls.
A control has one FUNCTION and one TYPE.
Example: A firewall is a Technical Preventive control. A mandatory vacation policy is an Administrative
Detective control.
Access Control Models
These are the theoretical frameworks that define how access is granted.
DAC (Discretionary Access Control):
How it works: The owner of the resource (e.g., a file, folder) decides who gets access. Access is typically
granted using Access Control Lists (ACLs).
Key Characteristic: Discretionary, user-controlled.
Example: Windows file system permissions, Unix/Linux permissions.
MAC (Mandatory Access Control):
How it works: Access is determined by the system, based on labels assigned to users (clearance) and
resources (classification). The user/owner cannot change this.
Key Characteristic: Non-discretionary, strict, used in high-security environments (military, government).
Example: A user with a "Secret" clearance can access a document labeled "Secret" but not one labeled
"Top Secret."
RBAC (Role-Based Access Control):
How it works: Access is based on the role a user has within an organization (e.g., "Accountant,"
"Manager," "Developer"). Permissions are assigned to roles, and users are assigned to roles.
Key Characteristic: Efficient for managing large numbers of users, follows the principle of least privilege
well.
Example: Everyone in the "HR" role gets access to the employee database.
ABAC (Attribute-Based Access Control):
How it works: A more dynamic model. Access decisions are based on a set of attributes (characteristics)
of the user, resource, action, and environment.
Key Characteristic: Very flexible and granular. Uses "if-then" rules.
Example: "IF ([Link] == "Manager" AND [Link] == "Sales" AND location == "Office" AND
time between 9 AM - 5 PM) THEN ALLOW Write access."
Rule-Based Access Control:
How it works: Global rules apply to all users. It's not based on the user's identity but on a set of
predefined rules.
Key Characteristic: Often used in network devices.
Example: A firewall rule that blocks all inbound traffic on port 80 after business hours.
Final Exam Tips:
Practice Questions: Find practice tests online specifically for the CC exam's access control domain.
Think in Scenarios: The exam will likely present scenarios. "A bank wants to prevent fraud in wire
transfers. Which principle should they implement?" (Answer: Segregation of Duties).
Link Concepts: Understand how these concepts work together. IAM implements the identity lifecycle to
enforce the principle of least privilege, using models like RBAC, and is audited through the Accounting
part of IAAA.
You have a perfect list of the core concepts. Memorize the acronyms, definitions, and key
differentiators. Good luck with your exam
100% preparation notes on the domain of access control for cc exam passing from this domain
Of course. Here are 100% preparation notes for the Access Control domain, structured for maximum
retention and exam success. This is a critical domain for the (ISC)² Certified in Cybersecurity (CC) exam.
Absolute Need-to-Know for the CC Exam: Access Control
1. Core Principles (The "Why")
These are the foundational philosophies guiding all access control decisions.
Principle of Least Privilege (PoLP)
Definition: Grant users only the minimum level of access—permissions, rights, and privileges—they need
to perform their job functions.
Exam Focus: It's the #1 best practice for reducing risk. Limits the "blast radius" of a compromised
account and prevents accidental misuse.
Key Term: Privilege Creep - When a user accumulates access rights over time as they change roles,
violating least privilege. Mitigated by periodic access reviews.
Separation of Duties (SoD) / Segregation of Duties
Definition: Splitting critical functions or tasks among multiple people to prevent fraud, error, and abuse.
Exam Focus: Requires collusion to bypass, making fraud harder. A key internal control.
Example: The person who requests a payment cannot be the person who approves it.
Two-Person Control (The Two-Person Rule)
Definition: A stricter version of SoD. Requires two authorized individuals to simultaneously approve a
single, critical action.
Exam Focus: Used for extremely high-risk actions where no single person should have control.
Example: Two officers turning keys simultaneously to launch a missile. Two sysadmins required to access
the root password vault.
2. Authentication Factors (The "How You Prove It")
Know these factors cold. The exam will test your ability to distinguish them.
Factor 1: Something You Know (Knowledge)
Examples: Password, PIN, Passphrase.
Key Term: Memorized Secret - The modern NIST term for a password/PIN. Policies should enforce
complexity and length.
Factor 2: Something You Have (Possession)
Examples: Smart card, Hardware/Software Token (Google Authenticator, RSA SecurID), Badge, Phone
(for SMS/App codes).
Factor 3: Something You Are (Inherence)
Examples: Fingerprint, Retina/Iris scan, Facial recognition, Voiceprint.
Other Factors (Contextual):
Somewhere You Are: (Location) Granting access based on IP address, GPS location, or network.
Something You Do: (Behavioral) Keystroke dynamics, signature analysis.
MULTIFACTOR AUTHENTICATION (MFA) IS NON-NEGOTIBLE.
Definition: Using two or more factors from different categories.
Crucial Distinction: A password + a security question are both Something You Know → Single-Factor. A
password + a code from your phone are two different factors → True MFA.
3. IAAA (The Access Control Framework)
This is the step-by-step process. You must be able to define each term.
Identification: The user claims an identity (e.g., enters a username, swipes a badge). "I am jsmith."
Authentication: The user proves that identity (e.g., enters a password, provides a fingerprint). "Prove
you are jsmith."
Authorization: The system determines what resources the now-authenticated user is allowed to access.
"jsmith is allowed to read File X but not delete it."
Accounting (Auditing): The system logs and tracks the user's actions (what they did, when they did it).
"jsmith read File X at 14:30." Essential for detective controls, forensics, and compliance.
4. Identity & Access Management (IAM) Lifecycle
The end-to-end process of managing a user's digital identity.
Provisioning: Creating the account and granting initial access (Onboarding).
Review: Periodically auditing user access to ensure it's still appropriate (e.g., User Access Reviews for
compliance).
Privilege Changes: Modifying access. This includes:
Escalation: Temporarily granting more access for a task.
De-escalation: Removing unnecessary access.
Deprovisioning: Disabling or removing all access when a user leaves or changes roles (Offboarding). THIS
IS CRITICAL. Orphaned accounts are a major security risk.
5. Security Controls: Function vs. Type
You will be asked to classify controls. A control has one Function (what it does) and one Type (what it is).
Function (Purpose) Description Examples
Preventive Stops an incident from happening. Firewall, Door Lock, MAC model
Detective Identifies and logs incidents during or after. CCTV, IDS, Audit Logs
Corrective Mitigates damage and restores systems after. Backups, Patching, Restoring
Deterrent Discourages an attack from occurring. Warning Signs, Fences, Lights
Compensating Provides an alternative to a primary control. Video surveillance compensating for a
broken lock.
PhysicalTangible, real-world barriers. Guards, Mantraps, Biometric Locks
Type (Nature) Description Examples
Administrative Policies, procedures, guidelines. Security Training, Hiring Policies, Plans
Technical Technology or software-based solutions. Encryption, ACLs, Antivirus, IDS
PhysicalTangible, real-world barriers. (Same as above) Locks, Fences, Guards
Exam Trick: A single control can be described by both. A firewall is a Technical Preventive control. A
mandatory vacation policy (to detect fraud) is an Administrative Detective control.
6. Access Control Models (The "How It's Enforced")
The theoretical models that define how access decisions are made.
DAC (Discretionary Access Control)
Control: The data owner decides who gets access.
Mechanism: Uses Access Control Lists (ACLs).
Example: File permissions on a Windows or Linux computer.
MAC (Mandatory Access Control)
Control: The system (or OS) decides based on security labels. The user has no say.
Mechanism: Uses clearances (for users) and classifications (for data).
Example: Military systems with Top Secret, Secret, Confidential labels.
RBAC (Role-Based Access Control)
Control: Access is based on the user's role within the organization.
Mechanism: Permissions are assigned to roles; users are assigned to roles.
Example: All "Accountants" get access to the financial software. Highly efficient for large organizations.
ABAC (Attribute-Based Access Control)
Control: A dynamic model. Access is based on attributes of the user, resource, action, and environment.
Mechanism: Uses "if-then" rules evaluating multiple attributes.
Example: IF ([Link]=Manager AND location=Office AND time=9-5) THEN ALLOW access.
Rule-Based Access Control
Control: Global rules that apply to all users regardless of identity.
Mechanism: Rules are typically defined on network devices.
Example: A firewall rule that "Blocks all inbound traffic on port 443 after 6 PM."
7. Key Terminology & Concepts
Privileged Access Management (PAM): A subset of IAM focused on controlling and monitoring super-
user/administrative accounts (the "keys to the kingdom"). Think tools like CyberArk.
Default to Deny: The safest configuration. Unless access is explicitly allowed, it is denied.
Implicit Deny: In access control lists (ACLs), if a rule doesn't explicitly permit access, it is automatically
denied.
Final Exam Strategy:
Scenario-Based Questions: The CC exam will present scenarios. Read them carefully. Identify the core
security principle being tested (e.g., "prevent fraud" -> SoD, "limit damage" -> Least Privilege).
Eliminate Wrong Answers: Often, two answers will be clearly wrong. Your job is to choose the best
answer from the remaining two.
Think Like a Security Professional: Always choose the most secure option that aligns with best practices
(Least Privilege, Defense in Depth, MFA).
You have everything you need here. Review this until you can recite it from memory. Good luck! You've
got this.