Discuss the benefits of technology to support Access Control.
Access Control, Authentication, and Public Key Infrastructure
Lesson 9
Physical Security
and Access Control
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
1
Learning Objective
Explore ways to secure the facilities that house sensitive resources and use biometric technology to verify identity.
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
2
Key Concepts
Holistic physical security plan
Biometric identity verification systems that meets organizational requirements
Technological access control solutions
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
3
Physical Security
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Perimeter security
Building security and access
Points of entry and exit
Physical obstacles and barriers
Access to physical areas within a building
Video Cameras Provide
Perimeter Coverage
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Classified Government Facilities
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Level I
Level II
Level III
Level IV
Level V
What you know—A password or pass phrase
What you have—A smart card or token
What you are—Biometric traits
Biometric Access Control Systems
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Types of Biometric Systems
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Fingerprint
Retina
Iris
Hand geometry
Facial recognition
Implementation Issues
False acceptance rate
The percentage of imposters that will be recognized as authorized users
False acceptances are often called Type II errors
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Implementation Issues
False rejection rate
The percentage of attempts by legitimate users that are rejected by the system.
False rejections are often called Type I errors
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Implementation Issues
Crossover error rate (CER)
The point at which Type I errors and Type II errors are equal
CER is an accurate way to compare the real accuracy of various biometric systems
The smaller the CER, the more accurate it is
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Implementation Issues
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Implementation Issues
Failure to enroll rate
The percentage of failed attempts to create a sample data set for an individual, divided by the total number of attempts to enroll users
Failure to capture rate
The percentage of failed attempts to authenticate to the system
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Modes of Operation
.
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Enrollment
Taking readings for an accurate image of an individual’s traits. This data is stored for later retrieval.
Identification
Taking a reading and comparing it to the previously stored data on an individual.
Biometric System Parameters
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Universality
Uniqueness
Permanence
Collectability
Performance
Acceptability
Anti-Circumvention
Legal and Business Issues
.
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
16
Privacy concerns
Cost-effectiveness of biometric solution
Cost of deployment and maintenance
Database storage and transmission
Law enforcement databases
Personal danger issues
Technology-Related Access Control Solutions
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Physical Locks
Electronic Key Management System (EKMS)
Fobs and Tokens
Common Access Cards (CAC)
Outsourcing Physical Security
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Benefits
Expertise
Risks
Lack of control
Impartiality
“Fresh eyes”
Best Practices for Physical Access Controls: Audit
Documentation of existing physical security measures
Nonstandard entry points to the facility as a whole and to sensitive areas within the facility
Standard access levels
Differences in security at various times, especially after hours
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Summary
Holistic physical security plan
Biometric identity verification systems that meets organizational requirements
Technological access control solutions
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.