Lab #3 – Assessment Worksheet
Identify & Classify Data for Access Control Requirements
Course Name & Number: IS3230 ______________________________________________________________
Student Name: Heather Young ______________________________________________________________________
Instructor Name: MR. Gibbs _____________________________________________________________________
Lab Due Date: Jan. 2014 _______________________________________________________________________
Overview
This lab provides the student with the opportunity to develop a data classification standard with procedures and guidelines to classify data access based on the job responsibilities – not an organizational position. In this lab, students aligned a data classification standard with the job function and roles that are required to access specific data. This alignment allows access controls policy definition to be properly implemented throughout the IT infrastructure to mitigate risk from unauthorized access.
Lab Assessment Questions & Answers
1. What is the Data Classification Standard used in the U.S. Department of Defense (DoD)/Military?Google “Data Classification Standard + DoD”. Summarize the different data classifications.
Top Secret- highest level of information sensitivity
Secret- information that would cause serious damage, most common classification level
Confidential- Is the lowest of sensitivity. This information may only be handled by personnel with a clearance, may not be disclosed to the public, and must disposed of in a secure manner.
Unclassified- Is not actually a classification level, it is the lack of classification level. It is used for information that the government has not classified under the security classification system
Controlled Unclassified Information (CUI)- there were hundreds of sub classifications , each with their own rules. They have now all been condensed into one category called CUI. Anyone can get access to unclassified information through legal means via a Freedom of Information Act (FOIA) request

2. Describe one way to help prevent unauthorized users from logging onto another person’s user account and accessing his/her data.
Need to have the employee change the password every month or so.
3. What permissions are necessary to allow an Active Directory Group called AD_Group to read and write files in a sensitive directory such as C:\ERPdocuments\HRfiles?
The Active Directory Schema snap-in allows schema administrators to manage the Active Directory schema by creating and modifying classes and attributes, and specifying which attributes are indexed and which attributes are to be catalogued in the global catalog. Administrators will not perform schema management tasks on a frequent basis, and they should take some care when modifying the schema. Management of the schema is restricted to a group of administrators called schema administrators. There are three safety precautions that control and limit schema modification: * By default, all domain controllers permit Read access to the schema. A registry entry must be set on a domain controller to permit Write access to the schema on that domain controller. * The schema object is protected by the Windows 2000 Security model; therefore, administrators must be given explicit permissions or be members of the Schema Administrators group to make changes to the schema. * Only one domain controller can write to the schema at any given time. This role is known as Schema Floating Single Master Operations (FSMO). You must be connected to the schema FSMO to manage the schema.

4. How would you apply the permissions (ACLs) stated above (M,RX) to the AD_Group on C:\ERPdocuments\HRfiles from the command prompt using built-in Windows tools?
You can use Xcacls.exe to set all file-system security options that are accessible in Windows Explorer from the command line. Xcacls.exe does this by displaying and modifying the access control lists (ACLs) of files.

5. When adding permissions to a directory in an Active Directory Domain, would you prefer to add Groups or individual User accounts to said directories? Explain. * Domain user accounts refer directly to the accounts in Active Directory. * SharePoint user accounts refer to the user accounts added to Windows SharePoint Services from Active Directory (or other authentication source).

6. Based on Microsoft’s Step-by-Step Guide on Understanding GPOs http://technet.microsoft.com/enus/library/bb742376.aspx what is the significance of the “Block Inheritance” feature of GPOs and why would it be used?
You can block inheritance for a domain or organizational unit. Blocking inheritance prevents Group Policy objects (GPOs) that are linked to higher sites, domains, or organizational units from being automatically inherited by the child-level.

7. What is the importance of the Security Groups created and why would we setup Security Group Filtering for GPOs as we have done?
Group Policy settings are enforced voluntarily by the targeted applications. In many cases, this merely consists of disabling the user interface for a particular function without disabling lower-level means of accessing it.
Alternatively, a malevolent user can modify or interfere with the application so that it cannot successfully read its Group Policy settings, thus enforcing potentially lower security defaults or even returning arbitrary values.

8. Explain the Principle of Least Privilege.
The principle of least privilege (POLP) is an information security term that refers to a design objective in computing that a given user should only be able to access the information and resources he or she requires for legitimate reasons. POLP states that every module of a system, such as a process, user or program should have the least authority possible to perform its job.

9. How does a Data Classification Standard influence your access control strategy?
Data classification is the need for a tiered storage architecture, which will provide different levels of security within each type of storage, such as primary, backup, disaster recovery and archive -- increasingly confidential and valuable data protected by increasingly robust security. The tiered architecture also reduces costs, with access to current data kept quick and efficient, and archived or compliance data moved to cheaper offline storage.
10. List and explain at least 1 benefit derived from properly implementing the Principle of Least Privilege.
The purpose of this principle is that if an account is compromised, an attacker will have minimal set of privileges and will not be able to use the comprised account to do real damage to the entire system.