topic Re: Conflict on Exception - Why is the most liberal action taken? in Training and Certification

Conflict on Exception - Why is the most liberal action taken?

Vivus — Mon, 14 Jun 2021 00:49:07 GMT

Hi there guys,

I'm currently looking over some material for the CCSA (have been particularly aided by ExamTopics - excellent for practice exam questions and actually free, thank God) and have come across a questions regarding conflict resolution within Security Policies.

Question

"What are the three conflict resolution rules in the Threat Prevention Policy Layers?"

Answer

"Conflict on action, conflict on exception, and conflict on settings"

Description

After doing a bit of reading up on these conflict resolution rules, I was particularly perplexed by the description for the Conflict on Exception which reads (CCSA R80.10 guide page 407 - I know this is a bit outdated as we're at R81.10 now... maybe this has changed?):

"Conflict on exception: The exceptions for a specified scope is different between layers. The action taken will be the most liberal, or least restrictive."

Any Ideas?

Can anyone explain why, if the conflict on action opts for the most restrictive option when a conflict occurs, the conflict on exception vouches for the least restrictive option? This seems to me like it might dangerously expose the system? Any insight is greatly appreciated.

Thanks Check Mates, 🍻

Vivus

Re: Conflict on Exception - Why is the most liberal action taken?

PhoneBoy — Mon, 14 Jun 2021 04:10:08 GMT

Thinking about it logically, an exception is generally to give you the option to reduce the level of enforcement for a specific protection, not increase it.
Therefore, to me at least, it would make sense that if there was a conflict for an exception, the least restrictive one would apply.
Not sure that's the official reason, but that's my take.

Re: Conflict on Exception - Why is the most liberal action taken?

Vivus — Thu, 17 Jun 2021 03:52:53 GMT

Hi PhoneBoy, thanks for the response. I had considered that, but then thought that if there was a lack of exception in one rule base it would imply that there may be reason to keep 'exceptional individuals' out, which compromises security if the two rule bases are merged and the least restrictive option is held.

I don't really know, maybe I'm overthinking it, haha.

Re: Conflict on Exception - Why is the most liberal action taken?

Jason_Tugwell — Thu, 17 Jun 2021 12:18:40 GMT

As a FYI, the source material is not up to date as that question is no longer on the exam. 🙂

Regards,

Tug