how Access Control takes into account human nature and ways to prevent issues.
sarath_007
access_ppt15_l08.pptxAccess Control, Authentication, and Public Key Infrastructure
Lesson 8
Access Control for Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
1
Learning Objective
Implement appropriate access controls for information systems within information technology (IT) infrastructures.
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
2
Key Concepts
The three states of data
File system access control lists
User account type privilege management
Access control best practices
Organization-wide layered infrastructure access control
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
3
DISCOVER: CONCEPTS
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
The Three States of Data
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Data at Rest (DAR)
Stored on some device
Archived records
Data in Motion (DIM)
Sending an e-mail
Retrieving a Web page
Data in Process
Creating a new document
Processing a payment
DIM
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Use encryption to protect stored data:
Elements in databases
Files on network and shared drives
Files on portable or movable drives, Universal serial bus (USB), and flash drives
Files and shared drives accessible from the Internet
Personal computers (PCs), laptop hard drives, and full disk encryption
Protecting DAR
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Difficult to protect since it is being operated on by the central processing unit (CPU)
Protecting DIP
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
File System Access Controls
File system access controls will include logging of user activities on the:
Files
Applications
Systems
Access Controls at Different Levels in a System
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Trust-Based Peer to Peer (P2P)
Workgroup
Role-Based Access
Group-Based Files Access
Types of File System Access Controls
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Microsoft (MS) Windows versus UNIX
File system controls in MS Windows and UNIX are different, but used to accomplish the same objective–control access to data assets
Types of File System Access Controls (Continued)
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Windows Folder Permissions
Folder security properties in Windows 8
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
3/30/2015
12
Windows Folder Permissions
Editing folder permissions in Windows 8
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
3/30/2015
13
Windows Folder Permissions
Windows 8 advanced file permissions
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
3/30/2015
14
UNIX-based Rights
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
3/30/2015
15
Changing UNIX File Permissions
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
3/30/2015
16
DISCOVER: PROCESS
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Layered Protection Through IT Infrastructure
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Layered Protection Through IT Infrastructure (Continued)
DMZ 2
DMZ 1
Dual DMZ Configuration
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: ROLES
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Roles and Responsibilities
| Role | Responsibilities |
| System Owner | Owns System Authorizes access Performs non-technical access control review |
| Network Administrator | Managing host security, file permissions, backup and disaster recovery plans, file system integrity, and adding and deleting users Troubleshoot networks, systems, and applications to identify and correct malfunctions and other operational difficulties |
| System Administrator | Grants access to system, applications, and data Provides special access as required Creates groups and assigns users and privileges Provides backup and recovery capabilities of systems, applications, and data |
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Roles and Responsibilities (Continued)
| Role | Responsibilities |
| Application Owner | Grants access to applications that manipulate data Maintains integrity of applications and processes |
| Data Owner | Maintains data integrity Authorizes distribution to internal and external parties |
| User | Uses systems, applications, and data to perform functions Creates file Assigns data classification |
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Summary
Three states of data
Protecting DIM and DAR
File system access controls
User account type privilege management
Layered protection
Roles and responsibilities
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Virtual Lab
Managing Linux Accounts
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
If your educational institution included the Jones & Bartlett labs as part of the course curriculum, use this script to introduce the lab:
"In this lesson, you learned about user rights and file permissions. You also explored how access controls are implemented in various operating systems, such as Microsoft Windows and UNIX-based systems.
In the lab for this lesson, you will create new user accounts on a Linux virtual machine and grant administrator privileges to one of those user accounts. You will also create two new security groups, add user accounts to those groups, and then delete one of those user accounts."
3/30/2015
24
Connection from
Internet
Firewall
External Router
Border Firewall Only
Internal Network
Connection from Internet
Router
Connection from Internet
