Question

***Need 200 words in total for the below questions***

1. Define the difference between need to know and principle of least privilege.
2. Name the common methods used to manage sensitive information.
3. What control prevents outages due to unauthorized modifications in system configuration?

Answer 1

1.The principle of least privilege implies that granting users only the rights and permissions they required to do their job and limit there. The main advantage of this idea is to avoid accidentally or deliberately creating problems.

Whereas the principle of need to know is intended to allow users access only to the data they required to do their job and limit there. For instance, one may have some special access to a secret data. But he/she does not have access to all critical data. So the person will be given access to the data he/she requires for a task. It prevents unauthorized access to the data.

2. The following methods can be employed to manage the sensitive information:

(i) Limit Access: An enterprise must be vigilant to limit access to their secret information.

(ii)Periodic Monitoring: It can sometimes detect any suspicious activity and helps in safeguarding the sensitive information.

(iii)Secure storage: The physical copies of vital information should be kept highly confidential. And digital copy should be password protected.

(iv)Metadata management: It is crucial as metadata may often contain sensitive information.

(v)Document sanitization: It is the technique of confirming that only the required information can be obtained from a documentation

3. Change control can be used to prevent outages caused by unauthorized modifications in system configuration. Change control systems will detect changes made and obstruct unwanted activities. Log files will keep track of all required data to revert to the previous stage. Changes in the file content can be compared to prevent outages. File integrity monitoring can easily detect the changes made to a file. Moreover, efficient alerting system can report the attempt to make severe changes. Thus it prevents the outages that may occur due to change in system configuration.