jperezduerto.info
Security in depth · Unit 22 · Lesson 27 of 44
Inherited access needs a review
Compare inherited access with the actual confidentiality requirement.
Helpful before thisWindows privilege escalation
After this lesson you can
- Identify an inherited grant that changes a child object’s effective access.
One idea. One situation. One reasoned decision.
How it works
Permissions can propagate from a parent container to child objects according to inheritance flags and object rules. Inheritance reduces repetitive administration but can spread an overly broad grant. A child may also have explicit permissions that need separate interpretation. Review effective access after reorganizing folders or changing group membership; a tidy folder structure does not prove that its permission model matches current responsibilities.
Read the supplied record
Assume the supplied effective DACL is complete for this ordinary read check and no deny, integrity, or other control changes the result.
| Evidence | Recorded fact |
|---|---|
| Owner-approved requirement | Only Reviewers may read |
| Explicit child entry | Reviewers: read |
| Inherited child entry | AllStaff: read |
The inherited grant creates a policy mismatch. Merely adding the narrower explicit allow does not remove the broader one. The record does not establish that anyone exercised the permission.
Before changing the parent, identify other children that legitimately rely on its policy. A correction may need a narrower container design or an explicitly governed inheritance exception. Record who owns that decision and how future children should behave.
After the change, verify both the intended reader and an ordinary staff member outside that role. Folder names and location alone do not establish the result.
The key distinction: Organization and authorization are separate properties.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
A report should be readable only by Reviewers. Its effective DACL also grants AllStaff read through inheritance. A staff member outside Reviewers meets all other access conditions. What does the record show?
Show the answer
Correct answer: A broader read grant than the stated policy permits. The inherited AllStaff grant matters to the effective DACL and conflicts with the supplied requirement.
Try it
- WriteExplain the policy mismatch in the supplied record and name one impact to check before changing the parent’s permissions.