A doctor has a patient's chart open on screen and is editing it. Which state are the data in, and which control protects them in that state?

Data in use, protected by access controls

Data in transit, protected by encrypting the network link

Data at rest, protected by locking the server room

Data at rest, protected by encrypting the drive

Which category of regulated data is this, and which law covers it?

Protected health information (PHI), covered by HIPAA

Personally identifiable information (PII) of children, covered by COPPA

Personally identifiable information (PII), covered only by the company's own policy

Payment card information (PCI), covered by PCI-DSS

Which access control model is being added to the existing system?

Rule-based access control (RuBAC)

Discretionary access control (DAC)

Role-based access control (RBAC)

Under the Bell-LaPadula model, which action is allowed?

A Secret-level analyst writes a report into a Top Secret file

A Confidential-level clerk reads a Secret file

A Secret-level analyst reads a Top Secret file

A Secret-level analyst writes a summary into a Confidential file

A new intern needs to read the marketing calendar. Which permission is the best choice under the principle of least privilege?

Read access to the marketing calendar only

Administrator access so the intern never needs to ask for help

The same access as the marketing manager

Read and write access to all marketing files

Which of the following best explains the + at the end of the permissions, and how can the administrator see more?

Extra permissions have been set for the file; view them with getfacl

The owner has administrator rights; view them with ls -l

The file is executable by everyone; view it with chmod

The file is encrypted; view it with openssl

Topic 5.2 · Unit 5: Securing Applications and Data · 45 minute session

5.2 Protecting Applications and Data: Managerial Controls and Access Controls

Data are protected according to their state (at rest, in transit, in use) and their classification; laws cover personally identifiable information (PII), protected health information (PHI) and payment card information (PCI). Managerial controls include a cryptography policy and a web application security policy. Access control models (role-based, rule-based, discretionary and mandatory: RBAC, RuBAC, DAC and MAC) decide which subjects get which operations on which objects, guided by least privilege. On Linux, ls -l shows rwx permissions for owner, group and others, and chmod changes them.

Big idea Decide who may do what to which data, write it down as policy, then enforce it: the fewest permissions that still let each person do the job.

Course and exam description (CED) codes covered: 5.2.A.15.2.A.25.2.A.35.2.A.45.2.A.55.2.B.15.2.B.25.2.C.15.2.C.25.2.C.35.2.C.45.2.C.55.2.C.65.2.C.75.2.D.15.2.D.25.2.D.35.2.D.45.2.D.55.2.D.65.2.D.7

Last reviewed against the CED: November 9, 2026

By the end of this session you can

5.2.A Explain how the state or classification of data impacts the type and degree of security applied to that data.
5.2.B Identify managerial controls related to application and data security.
5.2.C Determine an appropriate access control model to protect applications and data.
5.2.D Configure access control settings on a Linux-based system.

Already know this? Jump to the checkpoint.

1. Data state and classification (5.2.A)

Organizations apply specific security controls to comply with legal requirements, based on the types of data they collect, store, process and transmit 5.2.A.1. Data can be classified by their state 5.2.A.2:

State	Where the data are	How to protect them
Data at rest	Stored on a drive	Protect the physical drive from destruction or theft; encrypt the data so a thief cannot immediately read them
Data in transit	Being sent from one device to another	Protect the physical media (such as cables); encrypt so an interceptor cannot immediately read them
Data in use	Being processed by software or a person	Access controls limit who or what can view or edit them. Data must be unencrypted to be used

Organizations also categorize data by sensitivity and give more sensitive information a higher degree of security 5.2.A.3. Laws and regulations can require certain data to be stored, transmitted and handled by specific rules 5.2.A.4:

Type	Includes (not limited to)	Protected by
Personally identifiable information (PII): any data that allow someone to be identified	Name, signature, phone number, address, biometric data such as fingerprints, social security number, date of birth, email address	The Privacy Act of 1974; for children under 13, the Children’s Online Privacy Protection Act (COPPA) of 1998
Protected health information (PHI): data about an individual’s health, treatment or payment for healthcare at any time	Test results, treatment records, hospital records, doctor visit notes, health provider payment records	The Health Insurance Portability and Accountability Act (HIPAA) of 1996
Payment card information (PCI): data collected to process card payments	Name, account number, expiration date, address, card verification value (CVV) code	The Payment Card Industry Data Security Standard (PCI-DSS)

Organizations that collect regulated data label them and keep policies that meet the legal or regulatory rules for storing, transmitting and handling them 5.2.A.5.

2. Managerial controls for applications and data (5.2.B)

Policy	May include
Cryptography policy: acceptable encryption protocols and key parameters 5.2.B.1	Encryption algorithms approved for specific uses; minimum or maximum key lengths; key-generation requirements and parameters; key-storage requirements
Web application security policy: requirements for testing and fixing web application vulnerabilities 5.2.B.2	When an application is subject to a security assessment; timelines for fixing vulnerabilities by level of risk; how an assessment is done (specific tools or frameworks)

3. Access control models (5.2.C)

Access control enforces which users or applications (subjects) can access, modify, add or remove (operations) which files or applications (objects). An access control model describes how to decide which subjects get what access to which objects 5.2.C.1.

Model	How access is decided
Role-based access control (RBAC) 5.2.C.2	Every subject is assigned a role, and each role has set access to set objects
Rule-based access control (RuBAC) 5.2.C.3	A set of rules is checked to allow or deny access, such as rules about the time of day, the location, or the network or device a request comes from; usually layered on top of another model
Discretionary access control (DAC) 5.2.C.4	Subjects set the access other subjects have to objects they own. Administrators or super users can override them
Mandatory access control (MAC) 5.2.C.5	Strict rules for what each subject level may do to objects above, at or below its level. An external administrator assigns the levels

The Bell-LaPadula model is a MAC model often used by governments and militaries 5.2.C.6:

Simple Security Property: subjects may not read objects above their level.
* (Star) Security Property: subjects may not write to objects below their level.

Together: write up, read down (WURD). A Secret-level analyst can read Confidential reports and can write to a Top Secret file, but cannot read Top Secret or write to Confidential.

The principle of least privilege: give each entity exactly as much access as it needs to perform its function, and no more 5.2.C.7.

4. Linux permissions (5.2.D)

Authorization is when an entity is granted permission for a certain type of access to a resource; access controls decide which users have which types of access to which data 5.2.D.1.

Linux has three permissions, always in this order 5.2.D.2: read (view the contents), write (change the file) and execute (run a binary such as a program), shown as rwx. A - means the permission is absent, so read and execute only is r-x. They are set for three entities, always in this order, with no spaces 5.2.D.3: the file owner, the file group and all other users, as in rwxrwxrwx.

admin@clinic-fs: ~

$ ls -l
-rw-r-----  1 records doctors 8204 Nov  9 08:02 patients.csv
-rwxr-xr--+ 1 itadmin it     512 Nov  9 08:05 sync.sh
#  owner group others  (+ means extra permissions: run getfacl sync.sh)

ls -l shows the settings; a + at the end means other permissions are set, viewable with getfacl 5.2.D.4. chmod changes them, with the numeric or the symbolic method 5.2.D.5.

Numeric method 5.2.D.6 `chmod ### filename`	Symbolic method 5.2.D.7 `chmod entity+permission filename`
Digits in order: owner, group, others	Entities: u (user owner), g (group), o (others), a (all)
Add the values: 0 none, 1 execute, 2 write, 4 read	+ adds and - removes a permission
3 = write and execute, 5 = read and execute, 6 = read and write, 7 = all three	Permissions: r, w, x; entities and permissions can be combined
`chmod 640 patients.csv` gives `rw-r-----`	`chmod go-r notes.txt` removes read from group and others

Practice choosing the model, then set real permissions with the drop-down menus.

Lock it in: memory hooks

One picture per idea. If you remember the hook, you can rebuild the details.

Data statesRest on a drive, transit on a wire, use in a program. Encrypt the first two; control access to the third.
Access modelsRBAC: your job title. RuBAC: the rulebook. DAC: the owner decides. MAC: the label decides.
Bell-LaPadulaWURD: write up, read down.
chmod digitsRead 4, write 2, execute 1. Add them: 7 is everything, 0 is nothing.

Common misconceptions

"Encrypting data protects them in every state."
Not quite. Data in use must be unencrypted to be used. Access controls protect data in use; encryption protects data at rest and in transit.
"In Bell-LaPadula, you can write down to lower levels."
Not quite. It is write up, read down (WURD): no reading above your level (Simple Security Property) and no writing below it (* Security Property).
"chmod 640 gives the owner read and execute."
Not quite. 6 = 4 + 2 = read and write. Execute is 1, so read and execute would be 5.

Simulation · [5.2.C.2, 5.2.C.3, 5.2.C.4, 5.2.C.5, 5.2.C.6]

Access model drill: which model is in use?

Each organization below decides who (subjects) can do what (operations) to which files or applications (objects). Pick the access control model it is using.

At a hospital, everyone assigned the role "pharmacist" can update the medication stock system; no other role can.

Show the answer
Role-based access control (RBAC). Subjects get access through the role they are assigned, not individually.
A student creates a slideshow and gives her whole project group edit access. A week later she removes edit access from one teammate who keeps deleting slides.

Show the answer
Discretionary access control (DAC). The owner of the object decides, and changes, what access other subjects have.
A defense agency labels analysts and documents as Confidential, Secret or Top Secret. An external administrator assigns the labels, and a Secret analyst cannot read Top Secret files.

Show the answer
Mandatory access control (MAC). Strict rules by level, set by an external administrator. This is Bell-LaPadula: no read up.
A delivery app normally shows drivers a customer's phone number, but a rule hides it as soon as the delivery is marked complete.

Show the answer
Rule-based access control (RuBAC). A rule is checked before access is allowed, and it can deny access the driver would otherwise have. RuBAC is usually layered on top of another model.
An app store lets any developer decide which teammates can publish new versions of the apps that developer created.

Show the answer
Discretionary access control (DAC). Owners set access to the objects they own.

Simulation · Linux permissions [5.2.D.2, 5.2.D.3, 5.2.D.6, 5.2.D.7]

Permissions lab: set rwx with chmod

You are the system administrator for a clinic's Linux file server. Every file has three sets of permissions, always in the order owner, group, others, and each set is always read, write, execute.

Numeric method: add the values
Digit	Permissions	Built from
0	`---`	no permissions
1	`--x`	1 execute
2	`-w-`	2 write
3	`-wx`	2 write + 1 execute
4	`r--`	4 read
5	`r-x`	4 read + 1 execute
6	`rw-`	4 read + 2 write
7	`rwx`	4 read + 2 write + 1 execute

Tasks

shifts.txt (owner lead, group nurses). The owner and the nurses group can read and edit the shift list; everyone else can only read it.

Show the answer
chmod 664 shifts.txt gives -rw-rw-r--: owner rw- (6), group rw- (6), others r-- (4).
patients.csv (owner records, group doctors). The owner can read and edit; doctors can only read; everyone else has no access.

Show the answer
chmod 640 patients.csv gives -rw-r-----: owner rw- (6), group r-- (4), others --- (0).
backup.sh (owner itadmin, group it). A script. The owner and the information technology (IT) group can read, edit and run it; everyone else has no access.

Show the answer
chmod 770 backup.sh gives -rwxrwx---: owner rwx (7), group rwx (7), others --- (0).
kiosk.sh (owner itadmin, group it). A script. The owner and the IT group have full access; everyone else can read and run it but not change it.

Show the answer
chmod 775 kiosk.sh gives -rwxrwxr-x: owner rwx (7), group rwx (7), others r-x (5).

In ls -l output the first character is the file type (- for a file, d for a directory). A + at the end of the permissions means extra permissions are set; view them with getfacl.

Exam traps

Permissions always come in the order read, write, execute, and the three sets always go owner, group, others.
A + at the end of the ls -l permissions means extra permissions are set: view them with getfacl.
Rule-based access control is usually layered on top of another model, such as RBAC.
In MAC, an external administrator assigns the levels; in DAC, the object's owner decides.

By the numbers

Say each list out loud, then tap to check.

3 data states Say them, then tap

3 regulated data types Say them, then tap

4 access control models Say them, then tap

role-based (RBAC)
rule-based (RuBAC)
discretionary (DAC)
mandatory (MAC)

3 Linux permissions Say them, then tap

read (r, 4)
write (w, 2)
execute (x, 1)

3 entities Say them, then tap

owner (u)
group (g)
others (o)

a sets all

In 30 seconds

Data at rest: protect the drive and encrypt. In transit: protect the media and encrypt. In use: access controls, since data must be unencrypted to be used.
Organizations label regulated data (PII, PHI, PCI) and set policies to meet legal requirements.
A cryptography policy lists approved algorithms, key lengths and key generation and storage rules; a web application security policy sets when and how apps are assessed and how fast vulnerabilities are fixed.
Subjects perform operations on objects. RBAC, RuBAC, DAC and MAC decide who gets what, guided by least privilege.
ls -l shows permissions; chmod sets them with the numeric method (chmod 640 file) or the symbolic method (chmod g+w file).

Cover this list, say the points out loud, then take the checkpoint without scrolling back up.

Checkpoint · 10 questions

Checkpoint: Managerial Controls and Access Controls

Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.

1 A doctor has a patient's chart open on screen and is editing it. Which state are the data in, and which control protects them in that state? 5.2.A.2
AData in transit, protected by encrypting the network link BData at rest, protected by locking the server room CData at rest, protected by encrypting the drive DData in use, protected by access controls

Show answer

Answer: D. Data in use are being processed by software or a person. They must be unencrypted to be used, so access controls limit who can view or edit them.
A dental office stores X-ray results, treatment notes and records of insurance payments for each patient.

2 Which category of regulated data is this, and which law covers it? 5.2.A.4
APersonally identifiable information (PII) of children, covered by COPPA BPersonally identifiable information (PII), covered only by the company's own policy CPayment card information (PCI), covered by PCI-DSS DProtected health information (PHI), covered by HIPAA

Show answer

Answer: D. PHI is any data related to an individual's health, treatment or payment for healthcare, such as test results and provider payment records. HIPAA (1996) covers it.
"Files containing customer data must be encrypted with the Advanced Encryption Standard (AES) using keys of at least 256 bits. Keys must be stored in the approved key vault, never on the same drive as the files."

3 Which managerial control would most likely contain this requirement? 5.2.B.1, 5.2.B.2
AA software installation policy BAn acceptable use policy CA cryptography policy DA web application security policy

Show answer

Answer: C. A cryptography policy lists approved encryption algorithms, minimum or maximum key lengths, and key-generation and key-storage requirements.
A water utility already gives access to its control software by job role. It now adds a check that refuses any pump setting change sent from a device outside the control room network, even when the account belongs to an engineer.

4 Which access control model is being added to the existing system? 5.2.C.2, 5.2.C.3
ADiscretionary access control (DAC) BMandatory access control (MAC) CRole-based access control (RBAC) DRule-based access control (RuBAC)

Show answer

Answer: D. RuBAC checks a set of rules, such as time of day, to allow or deny access, and is typically layered on top of another model like RBAC.
A government agency uses three levels, from lowest to highest: Confidential, Secret and Top Secret.

5 Under the Bell-LaPadula model, which action is allowed? 5.2.C.5, 5.2.C.6
AA Confidential-level clerk reads a Secret file BA Secret-level analyst reads a Top Secret file CA Secret-level analyst writes a summary into a Confidential file DA Secret-level analyst writes a report into a Top Secret file

Show answer

Answer: D. Bell-LaPadula: subjects may not read objects above their level (Simple Security Property) or write to objects below their level (* Security Property): write up, read down.
6 A new intern needs to read the marketing calendar. Which permission is the best choice under the principle of least privilege? 5.2.C.7
ARead access to the marketing calendar only BAdministrator access so the intern never needs to ask for help CThe same access as the marketing manager DRead and write access to all marketing files

Show answer

Answer: A. Least privilege gives an entity exactly as much access as it needs to perform its function and no more.
An administrator wants this ls -l output for a script.

ls -l (desired)

Permissions Owner Group File
-rwxrw---- devlead builders build.sh

7 Which command sets exactly the permissions shown for the file? 5.2.D.2, 5.2.D.3, 5.2.D.6
Achmod 766 build.sh Bchmod 740 build.sh Cchmod 670 build.sh Dchmod 760 build.sh

Show answer

Answer: D. Owner rwx = 4+2+1 = 7, group rw- = 4+2 = 6, others --- = 0, so chmod 760.
An administrator runs chmod 461 log.txt.

8 After the command runs, what access does the group have to the file? 5.2.D.6
ARead and write BWrite and execute CRead, write and execute DRead only

Show answer

Answer: A. In chmod 461 the second digit is the group: 6 = 4 + 2 = read and write. The owner gets 4 (read) and others get 1 (execute).
9 Which command removes write permission from the group and from others, without changing the owner? 5.2.D.7
Achmod go-w notes.txt Bchmod u-w notes.txt Cchmod go+w notes.txt Dchmod a+w notes.txt

Show answer

Answer: A. Symbolic method: g is the group, o is others, - removes a permission and w is write.
An administrator runs ls -l on a shared folder.

ls -l

Permissions Owner Group File
-rw-r-----+ hr hrteam salaries.xlsx

10 Which of the following best explains the + at the end of the permissions, and how can the administrator see more? 5.2.D.4
AThe owner has administrator rights; view them with ls -l BThe file is executable by everyone; view it with chmod CExtra permissions have been set for the file; view them with getfacl DThe file is encrypted; view it with openssl

Show answer

Answer: C. A + at the end of the permissions in ls -l output means other permissions have been set, viewable with the getfacl command.

Permissions	Owner	Group	File
-rwxrw----	devlead	builders	build.sh

Permissions	Owner	Group	File
-rw-r-----+	hr	hrteam	salaries.xlsx

Key terms: flip the cards

Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.

Data at resttap to flip

Data stored on a drive; protect the physical drive from destruction or theft and encrypt the data so a thief cannot immediately read them.
Example and CED codes
Data in transittap to flip

Data moving across a network, as opposed to data at rest, which is stored on a drive.
Example and CED codes
Data in usetap to flip

Data being processed by software or a person; they must be unencrypted to be used, so access controls limit who can view or edit them.
Example and CED codes
Personally identifiable information (PII)tap to flip

Any data that allow someone to be identified, such as name, signature, phone number, address, biometric data, social security number, date of birth or email address.
Example and CED codes
Protected health information (PHI)tap to flip

Any data about an individual's health, treatment or payment for healthcare, such as test results, hospital records and doctor visit notes.
Example and CED codes
Payment card information (PCI)tap to flip

Data collected to process card payments: name, account number, expiration date, address and card verification value (CVV) code.
Example and CED codes
Cryptography policytap to flip

A managerial control describing an organization's acceptable encryption protocols and key parameters: approved algorithms, key lengths, key generation and key storage.
Example and CED codes
Web application security policytap to flip

A managerial control setting when web applications are assessed, how assessments are done, and timelines for fixing vulnerabilities by risk level.
Example and CED codes
Access control modeltap to flip

A method for deciding which subjects (users or applications) can perform which operations on which objects (files or applications).
Example and CED codes
Role-based access control (RBAC)tap to flip

An access control model that assigns every subject to a role and defines which roles have which access to which objects.
Example and CED codes
Rule-based access control (RuBAC)tap to flip

An access control model that checks a set of rules to allow or deny access, usually layered on top of another model.
Example and CED codes
Discretionary access control (DAC)tap to flip

An access control model where subjects set the access other subjects have to objects they own; administrators can override.
Example and CED codes
Mandatory access control (MAC)tap to flip

An access control model with strict rules for what each subject level may do to objects above, at or below its level; an external administrator assigns levels.
Example and CED codes
Bell-LaPadula modeltap to flip

A mandatory access control model: subjects may not read objects above their level (Simple Security Property) or write to objects below it (* Security Property).
Example and CED codes
Principle of least privilegetap to flip

The idea that entities should get exactly as much access as they need to perform their function, and no more.
Example and CED codes
Authorizationtap to flip

Granting an entity permission to have a certain type of access to a resource.
Example and CED codes
chmodtap to flip

The Linux command that changes file permissions, using the numeric method (chmod 640 file) or the symbolic method (chmod g+w file).
Example and CED codes

Questions students ask

What is the difference between RBAC and DAC?

In role-based access control, access comes from the role a subject is assigned. In discretionary access control, the owner of each object decides what access other subjects get.

What does chmod 754 do?

It gives the owner read, write and execute (4+2+1), the group read and execute (4+1) and everyone else read only (4).

What laws protect PII, PHI and PCI?

PII: the Privacy Act of 1974, and the Children's Online Privacy Protection Act of 1998 for children under 13. PHI: the Health Insurance Portability and Accountability Act of 1996. PCI: the Payment Card Industry Data Security Standard (PCI-DSS).