Section: Software Development Security

Section: Software Development Security

It is considered to be a 'Physical Control'
There are three broad categories of access control: administrative, technical, and physical.
Each category has different access control mechanisms that can be carried out manually or automatically. All of these access control mechanisms should work in concert with each other to protect an infrastructure and its data.
Each category of access control has several components that fall within it, a partial list is shown here. Not all controls fall into a single category, many of the controls will be in two or more categories. Below you have an example with backups where it is in all three categories:
* Administrative Controls
* Policy and procedures
- A backup policy would be in place
* Personnel controls
* Supervisory structure
* Security-awareness training
* Testing
* Physical Controls
* Network segregation
* Perimeter security
* Cmputer controls
* Work area separation
* Data backups (actual storage of the media, i:e Offsite Storage Facility)
* Cabling
* Technical Controls
* System access
* Network architecture
* Network access
* Encryption and protocols
* Control zone
* Auditing
* Backup (Actual software doing the backups)
The following answers are incorrect :
Password and resource management is considered to be a logical or technical control.
Identification and authentication methods is considered to be a logical or technical control.
Intrusion Detection Systems is considered to be a logical or technical control.
Reference : Shon Harris , AIO v3 , Chapter - 4 : Access Control , Page : 180 - 185

Explanation/Reference:
Explanation:
When information is encrypted using a public key, it can only be decrypted by using the associated private key. As the recipient is the only person with the private key, the recipient is the only person who can decrypt the message. This provides a form of authentication in that the recipient's identity can be positively verified by the sender. If the receiver replies to the message, the sender knows that the intended recipient received the message.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 784-785

"An important thing to note is that the Bell-LaPadula model was developed to make sure secrets stay secret; thus, it provides and addresses confidentiality only. This model does not address integrity of the data the system maintains - only who can and cannot access the data." Pg 214 Shon Harris: All-in-One CISSP Certification