15.01.2024 Views

CompTIA A+ Certification All-in-One Exam Guide

  • No tags were found...

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

for an access control list (ACL), a rich form of user and groups permissions.

But this security only extends to drives/cards formatted with modern file

systems such as NTFS, HFS+, and ext3/4. If you copy a file to a drive/card

formatted with exFAT or the older FAT32, such as many cameras and USB

flash drives use, the OS will strip all permissions and the file will be available

for anyone to read!

Access to user accounts should be restricted to the assigned individuals,

and those who configure the permissions to those accounts must follow the

principle of least privilege: Accounts should have permission to access only

the resources they need and no more. Tight control of user accounts is critical

to preventing unauthorized access. Disabling unused accounts is an important

part of this strategy, but good user account management goes far deeper than

that.

Groups are a great way to achieve increased complexity without

increasing the administrative burden on network administrators, because all

operating systems combine permissions. When a user is a member of more

than one group, which permissions does that user have with respect to any

particular resource? In all operating systems, the permissions of the groups

are combined, and the result is what you call the effective permissions the

user has to access a resource. As an example, if Rita is a member of the Sales

group, which has List Folder Contents permission to a folder, and she is also

a member of the Managers group, which has Read and Execute permissions

to the same folder, Rita will have both List Folder Contents and Read and

Execute permissions to that folder.

EXAM TIP You can use directory permissions to limit access to sensitive

information on a shared file server, protect user-specific files from snooping

by other users on a multiuser system, and protect the system’s own software

from being compromised by any scripts or programs the user runs. The job

doesn’t end here, though! Anyone with physical access to a drive can ignore

your controls. Use full-disk data encryption to protect data at rest (data in

storage, not in use or moving around the network).

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!