Page 959 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

advanced proofing techniques. They gather information from
customers and then verify the accuracy of this information using

national databases. These databases allow the organization to verify
items such as current and previous addresses, employers, and credit
history. In some cases, the proofing process gives the user a multiple-
choice question such as “Which of the following banks holds your
mortgage?” or “Which of the following is closest to your current
mortgage payment?”

Authorization and Accountability

Two additional security elements in an access control system are
authorization and accountability.

Authorization Subjects are granted access to objects based on
proven identities. For example, administrators grant users access to
files based on the user’s proven identity.

Accountability Users and other subjects can be held accountable for

their actions when auditing is implemented. Auditing tracks subjects
and records when they access objects, creating an audit trail in one or
more audit logs. For example, auditing can record when a user reads,
modifies, or deletes a file. Auditing provides accountability.

Additionally, assuming the user has been properly authenticated, audit
logs provide nonrepudiation. The user cannot believably deny taking
an action recorded in the audit logs.

An effective access control system requires strong identification and
authentication mechanisms, in addition to authorization and
accountability elements. Subjects have unique identities and prove
their identity with authentication. Administrators grant access to
subjects based on their identities providing authorization. Logging
user actions based on their proven identities provides accountability.

In contrast, if users didn’t need to log on with credentials, then all
users would be anonymous. It isn’t possible to restrict authorization to
specific users if everyone is anonymous. While logging could still
record events, it would not be able to identify which users performed
any actions.