access control

qkiii123

9781284198355_SLID_CH011.pptx

Home >Computer Science homework help >access control

Access Control Framework

CHAPTER 1

Learning Objective and Key Concepts

Define access control and identity management concepts.

Principal components of access control

Identification, authentication, and authorization

Logical access controls

Authentication factors

Learning Objective

Key Concepts

Access Control Framework

10/6/20

Access controls

Access control systems

Grant and restrict user access to information, systems, and other resources

Implement business rules

Direct policy implementation

Allow individuals access to information and resources necessary to perform their job but no more

Access and Access Control

Businesses need to protect:

Data

Systems

Network bandwidth

Other assets

How do you lock virtual doors and protect from unauthorized access?

What does access mean?

What is an access control?

What Is Access?

Access

The ability of a subject and an object to interact

What Is Access Control?

Access Control

Based on the formalization of those rules for allowing or denying access

Defines allowable interactions between subjects and objects

Based on granting rights or privileges to a subject with respect to an object

What Is Identity Management?

Identity management

Process of creating, maintaining, and revoking user accounts

Provides the mechanism used to authenticate users

Identity and access management (IAM)

Authentication

Allows you to confirm a person is who they claim to be

Authorization

Allows you to restrict activities to authorized actions

Principal Components of Access Control

Policies: Rules that govern who gets access to which resources

Subjects: The users, networks, processes, or applications requesting access to a resource

Objects: Resources to which the subject requests access

10/6/20

Access Control Systems

Organizations use procedures and tools to enforce policies.

Policies

Statements of business requirements regarding access to resources

Procedures

Nontechnical methods used to enforce policies

Tools

Technical methods used to enforce policies

Access Control Subjects (1 of 3)

Authorized

Authenticated credentials presented and approved

Unauthorized

Authenticated credentials presented but not approved for access

Unknown

Authenticated credentials have not been presented

Access Control Subjects (2 of 3)

Components of AAA (“triple A”) security

Authentication

Ensures users are who they claim to be

Authorization

Ensures an authenticated user is allowed to perform the requested action

Accounting

Maintains records of actions performed by authorized users

Access Control Subjects (3 of 3)

Subjects may include technological resources

Networks

Systems

Processes

Applications

Access Control Objects

Three main categories of objects protected by access control

Information - Any type of data asset

Technology - Applications, systems, and networks

Physical location - Buildings and rooms

Information – Most common asset in terms of IT access controls

Physical security – The process of ensuring no one without proper credentials can access physical resources

Access Control Process (1 of 2)

Identification

Subject presents credentials to the access control system

Authentication

System verifies and validates the subject’s identity

Authorization

System grants or denies access to an object

Access Control Process (2 of 2)

FIGURE 1-1 The access control process.

Identification

Is the first step in any access control process

System applies labels to the subject and the object

Subject labels – user ID, email, employee ID, other unique identifier

Object labels – Printer 1, Printer 2, on a network

Universal labels may be assigned that remain throughout the life cycle of the interaction

Unique labels provide accountability

Correlate subjects with actions when used with system logging facilities and authentication systems

Authentication (1 of 2)

Builds upon identification by requiring that the subject provide proof of its identity

Authentication Factors

Something you know

Password/passphrase, shared secret, PIN number

Something you have

Something only the subject has, such as a token, smart card, or ID badge

Something you are

Biometrics, iris scan, fingerprints

Authentication (2 of 2)

FIGURE 1-2 Iris scanning as an authentication technique.

Authorization

Set of rights defined for a subject and an object

Based on subject’s identity

Rules may be simple or complex

Balance between more secure complex systems and more administrative work and inconvenience

Complexity

Convenience

Logical Access Controls

Tools used to provide:

Identification

Authentication

Authorization

CONTROL

Logical Access Controls for Subjects (1 of 2)

Who

Identity of subject

What

Type of access being requested

When

The time of day or day of week the request is made

Where

How

Physical or logical location

Type of access that can be granted to a subject

Logical Access Controls for Subjects (2 of 2)

Access Levels

Administrative – Ability to read, write, create, and delete files

Author – Right to read and write to own files

Read only – Read but not edit files

No access – Denial of access

Group-Based Access Controls

Efficient

Effective in large organizations

Cluster individuals into groups (department, job role or title, or classification)

Access level assigned to group as a whole

Individuals may be members of multiple groups with different access levels for each group

Simplifies management of the rules

Logical Access Controls for Objects (1 of 2)

Data element

Table

Database

Application

System

Operating system

Network

Logical Access Controls for Objects (2 of 2)

FIGURE 1-3 An example of access rights in action.

Authentication Factors

Most authentication systems rely on something you know

Username and password

Access to highly sensitive data

Combine first two factors

Most sensitive data

Protect by using all three factors

Something you know

Something you have

Something you are

Something You Know

Simple passwords

Easy to use and remember

Easy for malicious users to guess

Creating stronger passwords

Use passphrases

Set minimum character length

Require uppercase and lowercase characters

Require numbers and punctuation marks

Use separate passwords for work and personal accounts

Something You Have (1 of 3)

Physical tokens or devices provide physical security

Time variable tokens automatically change password at regular intervals

Challenge-response tokens

Challenge

Response

FIGURE 1-4 Smart card authenticator issued to U.S. government employees.

Something You Have (2 of 3)

FIGURE 1-5 Google Authenticator app configured to work with a variety of services.

Google, Google Authenticator, and the Google logo are registered trademarks of Google Inc., used with permission.

Something You Have (3 of 3)

FIGURE 1-6 Push authentication request from Duo to a user’s smartphone.

Courtesy of Duo Security.

Something You Are (1 of 2)

Physical biometrics

Fingerprints, retinal scans, hand geometry, and facial recognition

Reliable and unique to individual

FIGURE 1-7 Fingerprint scanning for authentication.

Something You Are (2 of 2)

Behavioral biometrics

Speed of typing, writing rhythms, voice recognition

Requires training period for system to learn behavior pattern

FIGURE 1-8 Facial recognition in use at airport security screening (U.S. government photo).

Summary

Principal components of access control

Identification, authentication, and authorization

Logical access controls

Authentication factors

10/6/20