Identify unusual or suspicious activity

How do I separate restricted information from unrestricted information? What methods should I use to identify users who request access to restricted information?

What is the best way to permit only users I authorize to access restricted information? Where do I start? Identify unusual or suspicious activity.Document usage patterns for possible subsequent action.

In your Web browser, enter the following address: http://www.sans.org/rr. From the SANS InfoSec Reading Room page, click the “Authentication” link in the Category section. Select and read one or more reports and write a brief summary. In your Web browser, enter the following address: http://www.rsbac.org. Visit both the “What is RSBAC?” and “Why you need RSBAC” pages. Write a two- or three-paragraph summary of how RSBAC could increase the security of a commercial Linux system.

Solution: