PDF p.99
In progress
Account Restrictions
Summary
PDF p.99Policy-based restrictions help mitigate the risks of account compromise by controlling access based on location and time. These restrictions can be implemented using location-based policies, which rely on network or geographical location, and time-based policies, which control login times and durations.
In plain words
Supplementary — not from your PDFAccounts can be restricted by where and when they sign in: only from certain networks or countries, only during work hours, or only for a limited time. Impossible-travel checks flag sign-ins that are too far apart to be real.
Detailed explanation
PDF p.99-
Location-Based Policies
- Logical Network Location
- Identifiers: IP address, subnet, virtual LAN (VLAN), organizational unit (OU).
- Usage: Restricting logins to specific network locations (e.g., preventing local logins to servers in a restricted OU).
- Geographical Location
- IP Address: Maps to a location based on ISP information, with varying accuracy.
- Location Services: Uses GPS, cell towers, Wi-Fi hotspots, and Bluetooth signals for accurate positioning.
-
Time-Based Restrictions
-
Types of Policies
- Time-of-Day Restrictions: Establishes authorized login hours.
- Duration-Based Login: Limits the maximum login duration.
- Impossible Travel Time/Risky Login: Tracks login locations over time to detect infeasible travel distances.
- Temporary Permissions: Removes account from security roles or groups after a defined period.
-
Types of Policies
Important terms
taken from the text above- Identifiers
- IP address, subnet, virtual LAN (VLAN), organizational unit (OU).
- IP Address
- Maps to a location based on ISP information, with varying accuracy.
- Location Services
- Uses GPS, cell towers, Wi-Fi hotspots, and Bluetooth signals for accurate positioning.
- Time-of-Day Restrictions
- Establishes authorized login hours.
- Duration-Based Login
- Limits the maximum login duration.
- Impossible Travel Time/Risky Login
- Tracks login locations over time to detect infeasible travel distances.
- Temporary Permissions
- Removes account from security roles or groups after a defined period.
Examples & real-world scenarios
Supplementary — not from your PDF- Admin accounts allowed to sign in only from the admin VLAN.
- Contractors limited to 08:00–18:00.
- Blocking a login from Brazil 20 minutes after one from Manila.
Scenario
A payroll clerk's account signs in at 03:00 from an unknown country. Time-of-day and location policies block it and alert the SOC.
Common mistakes
Supplementary — not from your PDF- Relying only on IP-based geolocation, which can be inaccurate or spoofed through VPNs.
- Forgetting to remove temporary permissions automatically.
Practical skills
Supplementary — not from your PDF- Pick location and time rules for a type of account.
What I should remember
Key Points PDF p.99-
Location-Based Policies
- Logical Network Location: IP address, subnet, VLAN, OU.
- Geographical Location: IP address mapping, GPS, cell towers, Wi-Fi, Bluetooth.
-
Time-Based Restrictions
- Time-of-Day Restrictions: Authorized login hours.
- Duration-Based Login: Maximum login time.
- Impossible Travel Time: Detects infeasible travel distances.
- Temporary Permissions: Time-limited access.