These lessons I create I wanted to make sure they are not sounding redundant regarding the material. I don't have a problem with something building on on something else I just feel like there ar some redundancies in this training. review this and point them out please.

Understanding Access Control Concepts
Lesson Objective: The primary objective of this lesson is to equip participants with a comprehensive understanding of access control concepts, both physical and logical, as they pertain to Cybersecurity. By the end of the course, attendees will be able to apply best practices, industry standards, and ISC2 exam objectives related to access controls in real-world scenarios, thereby enhancing their preparedness for the ISC2 certification exam.
Lesson 1: Understand Access Control Concepts
Introduction to Access Control

•	Definition of Access Control: Access control is a fundamental security mechanism that regulates who or what can view or use resources in a computing environment. Implementing access control policies refines the level of access or least privilege to specific data, systems, and facilities, thus helping prevent unauthorized access.

•	Importance in Cybersecurity: Access control is crucial in cybersecurity as it protects sensitive information from unauthorized access, distribution, modification, or destruction. This practice reduces the risk of data breaches, protects organizational reputation, and ensures compliance with regulatory standards.

Three core principles for Access Controls: CIA Triad

•	Confidentiality: Ensures that sensitive information is accessible only to those authorized to have access. 

•	Integrity: Safeguards the accuracy and completeness of information and prevents unauthorized modification.

•	Availability: Ensures that information and resources are accessible to authorized users when needed.
Types of Access Control Models

•	Discretionary Access Control (DAC): These access rights are assigned at the discretion of the resource owner. 

o	For instance, a user can create a document and then decide whether other users can read, write, or execute that file. They can also share the file with specific individuals or groups.

•	Mandatory Access Control (MAC):  These controls rely on strict, centralized policies to dictate user-resource interactions and determine access levels based on security classifications rather than individual discretion. This makes MAC suitable for high-security environments where user access is contingent on assigned security clearances.

o	In a military facility, only personnel with a Top-Secret security clearance can access documents marked as Top-Secret.

•	Role-Based Access Control (RBAC): Key features include assigning users roles with associated access permissions, which simplifies administration, enhances security, reduces the risk of excessive access rights, and facilitates easy management of user permissions as organizational roles change.

o	In a hospital, doctors have access to patient records, nurses can update treatment information but not billing details, and administrative staff can manage appointments.

•	Attribute-Based Access Control (ABAC): These types of controls employ policies that leverage multiple attributes—such as user, resource, and environment—to make dynamic access decisions, offering flexibility to adapt to changing access needs without redefining roles.

o	A cloud storage service where a user can access their files only if they are logged in from a corporate network (environment attribute), are part of the finance department (user attribute), and are accessing files marked for internal use (resource attribute).
Access Control Mechanisms

•	Mechanisms for authentication: Authentication mechanisms are vital for verifying a user’s identity before granting access to systems or resources. 

o	Passwords: These are the most common form of authentication, where users create a unique password to protect their accounts, but they are vulnerable to various attacks such as phishing, brute force, and dictionary attacks if not managed securely.

o	Multi-Factor Authentication (MFA): Enhances security by requiring users to provide additional verification factors, such as a One-Time Password (OTP) sent to a mobile device, in addition to their password, significantly reducing the risk of unauthorized access. 

•	Authorization approaches: These define how access to resources is controlled and managed within a system, ensuring that users can only perform actions for which they have been granted permission. 

o	Permissions: Permissions determine what actions users can take on resources, such as reading, writing, or executing files, ensuring users can only interact with resources in allowed ways to maintain security.

o	Access Rights: Access rights define the level of access different users or roles have, specifying what resources they can access and what actions they can perform, like whether they can view or edit files. 

•	Accountability: Accountability in information security involves tracking user actions to ensure responsible resource use and detect suspicious activities.

o	Audit Logs: Audit logs record user activities and access events, helping organizations detect suspicious behavior and investigate incidents by showing who accessed what resources and when. 

o	Monitoring Access: Continuous monitoring of user access allows organizations to identify potential security incidents in real-time and ensure compliance with regulations by quickly responding to unusual activities.
Risk Assessment and Compliance

•	Involve evaluating potential threats to an organization’s assets and ensuring compliance with regulations that protect sensitive information.

o	Importance of Risk Assessment in Access Control: Regular risk assessments are vital for ensuring that access control measures effectively mitigate potential threats and vulnerabilities related to unauthorized access. 

o	Regulatory Compliance (GDPR, HIPAA, etc.): Compliance with regulations such as the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA) imposes specific requirements for access control practices to safeguard sensitive data.

o	Strategies for Maintaining Compliance: a set of planned actions and best practices that an organization implements to ensure continued compliance with laws, regulations, and internal policies relevant to their operations, particularly in relation to data protection, information security, and access control. Below are a few Key Strategies:

	Ongoing risk assessments
	Employee training
	Incident response plans
	Policy Updates and Reviews 
Lesson 2: Understand Physical Access Controls
Overview of Physical Access Controls
Physical access controls are measures taken to protect physical IT assets and facilities from unauthorized access, damage, or interference. These controls serve as the first line of defense in securing data, hardware, and other resources against physical threats such as theft, vandalism, and natural disasters. 
Importance in Security: They are critical in system protection and safeguarding against unauthorized entry, theft, vandalism, and potential harm to personnel or assets. By managing physical access, organizations can protect valuable resources, ensure safety, and mitigate risks associated with physical breaches.

•	Confidentiality: Ensures that sensitive areas are only accessible to authorized personnel, protecting sensitive information and operations.

•	Integrity: Safeguards the physical security of resources to prevent tampering or unauthorized alterations.

•	Availability: Guarantees that authorized individuals can access facilities and resources when needed without unnecessary barriers.

Three core principles for Physical Controls: CIA Triad 

•	Confidentiality: Utilizes access control systems (e.g., key cards, biometric systems) to restrict entry to physical locations where confidential information is stored, ensuring only authorized personnel have access.

•	Integrity: Implements physical barriers and tamper-evident seals on sensitive equipment and data storage devices to prevent unauthorized access or alterations, thereby ensuring that physical access does not compromise the accuracy and completeness of the information.

•	Availability: Implements surveillance systems and security personnel to monitor physical spaces, ensuring that access to resources is maintained for authorized users and quickly responding to potential threats.

Key Functions of Physical Access Controls
•	Access Restriction: Limiting entry to buildings, rooms, or specific areas where IT infrastructure or sensitive data is stored.

•	Surveillance: Monitoring facilities and critical areas to detect unauthorized access or suspicious activities.

•	Incident Response: Enabling rapid response to physical security breaches or emergencies.

•	Accountability: Maintaining records of who accesses facilities and when to trace back actions in case of incidents.
Physical Access Control Mechanisms 

•	Lock and Key Systems: These are structures or natural features that prevent unauthorized entry, such as fences, gates, and secure facility layouts.

o	Mechanical Locks: Traditional locks that require physical keys, such as padlocks, deadbolts, and pin-tumbler locks.

o	Smart Locks: Electronic locks that can be controlled via smartphones, key fobs, or biometric recognition systems.

•	Keypads and PINs: These are security tools used to access secure systems or devices. 

o	Numeric Keypads: Require users to enter a pre-set Personal Identification Number (PIN) to gain access.Design of a building or campus that includes secure areas, restricted access zones, and strategically placed entrances and exits.

o	Touchscreen or Gesture-Based Input: More advanced systems that can also include biometrics or pattern recognition.

•	Turnstiles and Barriers: These are physical security devices used to control access to certain areas, ensuring that only authorized individuals can enter or exit.

o	Physical Barriers: Turnstiles, gates, and security doors that restrict access until proper authentication is provided.

o	Bollards and Traffic Barriers: Used to control vehicle access to certain areas.

•	Surveillance and Monitoring Systems: These are security tools used to observe and record activities in a specific area to enhance safety and security.

o	Closed-Circuit Television (CCTV) Cameras: Used in conjunction with physical access controls to monitor entry points and deter unauthorized access.

o	Alarm Systems: Integrated with access control systems to alert security in case of unauthorized access attempts.

o	Drone Surveillance: This is a type of technology that uses drones with cameras and sensors to monitor areas or activities from the air. 
Recongition of our Founders in Technology
Albert L. and Marie V. Brown are the inventors who lived in Jamaica Queens, New York. In 1966, they invented a video home security system. She was a nurse and he was an electronics technician. With her idea and his expertise they created the system applied for a patent for their innovative security system, which was granted in 1969. 
This made them the first couple to develop a patent for closed- circuit television security. The Brown's system had a set of four peepholes and a camera that could slide up and down to look out each one. Anything the camera picked up would appear on a monitor. An additional feature of The Brown's invention was that a person also could unlock a door with remote control. They created this system because of high crime in their area  and slow police responding to emergencies in their neighborhood. The “audio-video alarm system” could be used to see who was at the door and interview them as well. 
She was given an award from the National Scientists Committee (NSC). Her invention became the framework for the modern closed-circuit television system that is widely used for surveillance, crime prevention and traffic monitoring.
Their contribution led to the advancement of home and cctv survalince as follows:
•	Closed-Circuit Video Technology: The original home security system employed closed-circuit video to transmit footage to a monitor. CCTV systems adopted this concept for secure video transmission between cameras and monitors.

•	Multiple Camera Setup: Brown's system featured multiple cameras positioned to monitor different areas of a home. This concept has been integrated into modern CCTV systems that allow for multiple cameras to cover various angles and locations.

•	Remote Monitoring: The ability to view footage from a remote location was foundational in Brown's invention. Modern CCTV systems have greatly expanded this capability, allowing homeowners to access feeds via mobile apps and computers.

•	Alarm Notification: Brown's system incorporated a mechanism that alerted occupants when someone approached their home. This concept has evolved in CCTV systems, which can now send instant notifications or alerts based on motion detection and other triggers.

•	Control Panel features: The use of a control panel in Brown's system to operate the cameras and security features has been mirrored in CCTV systems that often come with user-friendly interfaces who manage settings, camera angles, and alerts.

•	Integration with Door Entry Systems: Brown’s system included features that could be integrated with door entry systems, such as intercoms. Modern CCTV often integrates with smart doorbell cameras and entry systems, providing a comprehensive view at entry points.
Mechanisms Supporting Physical Access Controls

•	Alarm Systems: Security alarms that activate if unauthorized access is attempted or if there is a breach.

•	Access Logs: Records created by access control systems to capture the identity or credentials of individuals entering or leaving a facility.

•	Emergency Exits: Clearly marked and accessible emergency exits equipped with appropriate alarm systems. 

•	Electronic Monitoring Systems: Integration of sensors and alarms with management systems to provide centralized monitoring.
Policies and Procedures for Physical Security

•	Importance of Physical Security Policies: Formalized policies provide guidelines for how physical assets should be protected, ensuring consistent enforcement and compliance.

•	Visitor Management and Access Restrictions: Implementing a system to manage visitor access (check-in procedures, visitor badges) ensures only authorized personnel access sensitive areas.

•	Employee Training and Awareness Regarding Physical Security Measures: Continuous training ensures employees understand the importance of physical security and their role in enforcing it, including reporting suspicious behavior and adhering to access policies.
Lesson 3: Understand Logical Access Controls
Overview of Logical Access Controls
Logical access controls govern how users interact with IT resources. They are designed to protect data integrity, confidentiality, and availability by ensuring that only appropriately authenticated users can access systems and can only perform permitted actions.
Three core principles for Logical Controls: CIA Triad 

•	Confidentiality: Involves authentication mechanisms (e.g., usernames, passwords, multi-factor authentication) that verify user identities before accessing sensitive data or systems.

•	Integrity: Incorporates encryption protocols that safeguard data both in transit and at rest, preventing unauthorized alterations and ensuring data remains accurate and trustworthy.

•	Availability: Implements redundancy strategies (e.g., load balancing failover clusters) and performs regular system maintenance and updates to ensure that systems remain reliable and available to authorized users when needed. 
Authentication Methods

•	Something you KNOW - This method relies on information that the user knows. Common examples include: 

o	Passwords: The most widely used method. Users create a secret password that must be entered to access a system. Passwords should be complex and unique to reduce the risk of being compromised.

o	PINs (Personal Identification Numbers): Short numeric codes used mainly in mobile devices and ATMs. They are often simpler than passwords but still must be kept secret. 

o	Security Questions: Users answer personal questions (e.g., mother's maiden name, first pet's name) as an additional authentication step. These can be less secure if answers are easily guessed or found online. 

•	Something you HAVE - This method requires a physical device that the user possesses:

o	Smartcards: Physical cards embedded with an electronic chip that store authentication data and can be used for access control in secure environments. 

o	Hardware Tokens: Small devices that generate one-time passwords (OTPs) or codes (e.g., RSA SecurID) at regular intervals. Users enter the current code along with their username/password for dual-factor authentication (2FA). 

o	Mobile Authentication Apps: Applications like Google Authenticator or Authy generate time-sensitive OTPs that users input for two-factor authentication. 

•	Something you ARE - This method uses unique biological traits for identification:

o	Iris Recognition: Analyzes unique patterns in the iris of the eye for identification, usually requiring specialized hardware.

o	Voice Recognition: Uses vocal characteristics to identify users; can be affected by background noises and changes in the user's voice due to illness, for example. 

o	Fingerprint Recognition: Scans and matches the user's fingerprint against a database. Widely used in smartphones and secure facilities. 

o	Facial Recognition: Uses algorithms to compare a live image or video of the user's face against stored images. Common in devices like smartphones and surveillance systems. 

•	Two-Factor Authentication (2FA) and Multi-Factor Authentication (MFA)

o	Two-Factor Authentication (2FA): Involves two different methods of authentication from two of the above categories (e.g., password and OTP). This adds a layer of security, as gaining access requires both factors. 

o	Multi-Factor Authentication (MFA): Similar to 2FA but involves three or more factors from different categories. For example, using a password, a fingerprint, and a hardware token. 

•	Behavioral Authentication - This newer method analyzes patterns in user behavior:

o	Keystroke Dynamics: Monitors how a user types (speed, rhythm) and compares it to their established patterns.

o	Mouse Movement Analysis: Tracks how a user interacts with their mouse (click patterns, movement speeds) to identify if the current user matches the profile.

o	Location-Based Authentication: Assesses the geographic location of the user via IP address or GPS. Login attempts from unusual locations may trigger additional security steps. 

•	Certificate-Based Authentication - This method uses digital certificates to identify users, devices, or systems:

o	Public Key Infrastructure (PKI): Involves the issuance of digital certificates that contain the user's public key and is verified by a trusted certificate authority (CA). This method is commonly used in secure web browsing (HTTPS) and VPNs.
Authorization and Access Management

•	Principle of Least Privilege (PoLP): The Principle of Least Privilege is a critical security concept that ensures users have the minimum level of access—or permissions—necessary to perform their job functions effectively. Here are some key aspects to consider:

o	Implementation: Implementing PoLP involves closely analyzing the necessary permissions for each role within the organization and configuring access controls accordingly. This often requires collaboration between security, IT, and business units to understand the specific needs of various roles.

o	Regular Audits: Regular audits of user permissions are essential for maintaining PoLP. Organizations should conduct periodic reviews to ensure that users’ access levels align with their current responsibilities. Unauthorized or excessive permissions should be revoked promptly.

o	Automation Tools: Leveraging automation tools for monitoring and managing permissions can help maintain PoLP effectively. Tools can track changes in user roles and automatically adjust permissions accordingly, minimizing the administrative burden.

•	Role Management and User Lifecycle Management (ULM): ULM involves managing the entire lifecycle of a user’s access—from onboarding to offboarding. Effective ULM practices include:

o	Onboarding: Immediately granting appropriate access rights when a user joins ensures they have the tools necessary to be productive from day one.

o	Ongoing Management: As users change roles (promotions, transfers, etc.), their access rights should be adjusted without delay. This requires a solid process for tracking role changes.

o	Offboarding: When users leave the organization, their access must be revoked immediately to protect against potential data breaches. Automated workflows can streamline this process to minimize human error.

•	Use of Access Control Lists (ACLs) and Management of Entitlements: An ACL specifies the permissions associated with each resource, indicating which users or roles can interact with that resource and what actions they can perform (e.g., read, write, execute). ACLs can be implemented at various levels, including application, file system, and network resources.

o	Application-Level ACL 

	Admin Role: Permissions: Read, Write, Delete (can manage all settings and user accounts) 

	Editor Role: Permissions: Read, Write (can create and edit content, but cannot delete any content or manage user accounts)
	Viewer Role: Permissions: Read (can only view content, no ability to edit or manage anything)

o	File System ACL

	User A (Sales Manager): Permissions: Read, Write, Delete (can manage all files)

	User B (Sales Associate): Permissions: Read, Write (can add or modify files but cannot delete)

	User C (Intern): Permissions: Read (can view files but cannot modify or delete)

o	Network Resources ACL

	Allow: 192.168.1.10 (Internal IP for trusted users, can access the web server)

	Allow: 10.0.0.0/24 (Allow all devices in this subnet to access the web server)

	Deny: 0.0.0.0/0 (Deny all other traffic from external sources)

•	Management of Entitlements: Refers to the processes and practices that govern the distribution, maintenance, and oversight of user permissions and access rights within an organization. 

o	Regular Review: Similar to PoLP, it’s crucial to regularly review entitlements to ensure that only necessary privileges are assigned. This can help identify and mitigate risks associated with excessive permissions.

o	Access Request and Approval Workflows: Establishing formal workflows for requesting and granting access can improve security and accountability. Proper documentation and approval processes help prevent unauthorized access.

o	Integration with Identity Management Systems: Using identity and access management (IAM) solutions can streamline the management of ACLs and entitlements by providing centralized controls and visibility over permissions. 
Monitoring Access Control & Incident Response
Monitoring Access Control
•	Detection of Unauthorized Access: Immediate alerts for unauthorized access attempts help identify potential breaches.

•	Behavioral Analysis: Establishing normal access patterns allows for quick identification of anomalies.

•	Incident Response: Real-time monitoring enables swift detection and mitigation of security incidents.

•	Audit Trails and Forensics: Detailed logs support investigations and reconstruct events after incidents.

•	Compliance Requirements: Monitoring is essential for meeting regulatory standards such as GDPR, HIPAA, and PCI DSS.
Incident Response
•	Timely Detection and Reaction: Quick responses minimize damage and impact from security incidents.

•	Structured Process: Ensures consistency and effectiveness in addressing and resolving breaches.

•	Compliance and Legal Protection: Meeting regulations reduces legal liabilities through documented response procedures.

•	Stakeholder Confidence: Demonstrates commitment to cybersecurity, fostering trust with clients and partners.

•	Continuous Improvement: Regular updates to response plans ensure effectiveness against evolving threats and technologies.
Final Thoughts:
I want you to understand the importance of access controls and reflect on their vital role in cybersecurity. Understanding physical and logical access controls helps protect sensitive information and maintain system integrity. Remember the CIA triad—confidentiality, integrity, and availability as you implement access controls in real-world scenarios. Your dedication to mastering access control will enhance your skills and contribute to a more secure digital environment.
Case Studies and Best Practices
NASA Jet Propulsion Laboratory (JPL) Incident: A report published this week by the NASA Office of Inspector General reveals that in April 2018, hackers breached the agency’s network and stole approximately 500 MB of data related to Mars missions. 
Breach Details: Unauthorized access to NASA’s Jet Propulsion Laboratory’s (JPL) IT network occurred when a Raspberry Pi device was connected without proper authorization. This device circumvented the existing security protocols and provided hackers with a pathway to sensitive systems, which are crucial for various critical missions. 
Key Issues
Improper Device Management: The incident highlighted the lack of adequate controls related to the management of unapproved devices connecting to the network. There was no established protocol to vet devices before granting them access.
Insider Threat and Lack of Oversight: The breach pointed to the potential for insider threats, given that unauthorized hardware was able to connect due to the absence of stringent policies and oversight mechanisms. The lack of monitoring for network access further worsened the issue, leading to undetected anomalies.
Consequences: The breach raised the alarm regarding the potential exposure of sensitive data, including operational information and the integrity of the systems that support NASA’s essential scientific and exploratory missions.
Best Practices
•	Establish a Strong Device Management Protocol:

o	Device Authorization Policy: Implement a strict policy that requires all devices to be registered and authorized before they can connect to the network.

o	Device Acceptance Listing: Create an acceptance list of approved devices. Only devices on the list should be able to access sensitive network areas.

o	Device Inventory Tracking: Utilize tools to maintain a real-time inventory of all devices connected to the network, including details like device type, owner, purpose, and connection time.

•	Improve Network Segmentation: Divide the network into distinct segments with strict access controls. Sensitive systems, such as those supporting Mars missions, should be isolated from general-use networks.

o	Access Controls by Role: Implement role-based access control (RBAC) to restrict access to sensitive information based on an individual’s job role and necessity.

•	Deploy Intrusion Detection and Prevention Systems (IDPS): 

Continuous Monitoring: Use IDPS to monitor all network traffic for abnormal behavior or unauthorized access attempts.