CND (312-38) Network Defense Simulation

You are auditing a newly acquired small business's internal network. You discover there is no centralized directory service (like Active Directory) in place. The environment operates entirely as a Windows Workgroup (peer-to-peer network).

During the security audit, you notice several instances of unauthorized access to sensitive financial spreadsheets. When investigating, you find that the users who created the folders explicitly granted "Full Control" access to "Everyone" so their coworkers could edit the files without bothering the IT manager, Ross.

Windows Security Log Extract & PowerShell ACL Audit

Analysis: The audit logs confirm that the file owner (Ross) utilized standard Windows GUI tools (explorer.exe) to modify the Access Control List (ACL) directly, granting unrestricted access to the network share at his own discretion.

Ross manages 30 employees and only 25 computers in the organization. The network the company uses is a peer-to-peer. Ross configures access control measures allowing the employees to set their own control measures for their files and folders. Which access control did Ross implement?

1. What is happening in the network

The network is relying on a decentralized file-sharing model where the creator of a resource is automatically considered the "owner." In this peer-to-peer setup, data owners have the ultimate authority to dictate exactly who can read, write, or execute their files. Because end-users often prioritize convenience over security, this routinely results in overly permissive access rights (e.g., "Everyone - Full Control").

2. Identify attack or behavior

The core behavior observed here is decentralized identity and access management. Without a central authority enforcing policy, security is left entirely to the discretion of the end-user. While not inherently an attack, this misconfiguration frequently leads to data breaches, insider threats, and lateral movement by malware (like ransomware) across permissive network shares.

3. Why Option C is correct

Discretionary Access Control (DAC) is an access policy determined by the owner of an object. The owner decides who is allowed to access the object and what privileges they possess. Because employees are setting "their own control measures for their files," this is a textbook implementation of DAC.

4. Why others are wrong

• A. Mandatory Access Control (MAC): In MAC, access is centrally controlled by the operating system based on strict security labels (e.g., Top Secret) and user clearances. Users cannot alter these permissions.
• B. Non-discretionary access control: This is a broad category that encompasses models where access decisions are not left to the user's discretion, such as RBAC.
• D. Role-based access control (RBAC): Access is based on the user's job function or role within the organization. A central administrator defines the roles and permissions, not the end-users.

5. Defensive action

As a network defender, the immediate remediation is to migrate the peer-to-peer network to a client-server architecture using a central directory service (like Active Directory). Implement Role-Based Access Control (RBAC) based on the Principle of Least Privilege, completely removing the ability for standard users to alter network share permissions.