Discuss the benefits of technology to support Access Control.
sarath_007
access_ppt15_l10.pptxAccess Control, Authentication, and Public Key Infrastructure
Lesson 10
Access Control in the Enterprise
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
1
1
Learning Objective
Design appropriate authentication solutions throughout an information technology (IT) infrastructure based on user types and data classification standards.
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
2
2
Key Concepts
Different users and their authentication requirements
Remote Authentication Dial In User Service (RADIUS) and Terminal Access Controller Access Control System Plus (TACACS+) authentication server deployments
Multifactor authentication
Authentication requirements for the IEEE 802.11 wireless local area networks (WLANs) infrastructure
Best practices for private and public sector authentication
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
3
3
Access Control Lists (ACLs) and Access Control Entries (ACEs)
ACL is made up of ACEs
ACE
Contains at least two items, a security identifier (SID) and one or more authorization levels for each SID
SID
Is created for a user, group, or computer account when a new account is first created on a network
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
4
Example of ACL Permissions
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Access Control Models
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
6
Discretionary access control (DAC)
Policy defined by the object owner
Mandatory access control (MAC)
Policy defined by the system
Role-based access control (RBAC)
Attribute-based access control (ABAC)
Policy defined by the functions the user performs within the organization—for instance, roles can be Human Resources or Finance
Policy a function of a subject’s characteristics
Authentication Factors
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
7
Something you know
Something you have
Something you are
Challenge-Response
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Kerberos
A network security protocol that provides authentication and authorization services on a network
Based on three systems:
Kerberos-trusted Key Distribution Center (KDC)
Kerberos Ticket-Granting Service (TGS)
Kerberos Authentication Service
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
9
9
Kerberos Process
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Potential Weaknesses of Kerberos
Brute-force attacks
Key storage
Kerberos tickets are cached on a user’s computer system
Clocks must be synchronized to complete authentication
Central server continuous availability requirement
Requirement for host synchronization
Potential single point of failure
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
11
11
Network Access Control
The use of policies within a network infrastructure to limit access to resources until the system proves that it has complied with the policy
NAC components include:
Computer systems, routers, switches, servers, and network firewalls
Example: A router might not allow you network access if you do not have the correct IP address associated with your computer
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
12
The OSI Reference Model
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Media Access Control (MAC) Address
A unique identifier of a network device
When a device is powered up, the MAC address is sent out on the network connection
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
14
Layer 3 Techniques
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
15
Access control lists
Route maps
Disabling IP routing for complete IP traffic isolation
Wireless IEEE 802.11 LANs
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
16
Access control to IEEE 802.11 WLANs
Identification
Confidentiality
Authorization
Single Sign-On (SSO)
A method of access control that allows a user to log on to a system and gain access to other resources within the network via the initial logon
Eliminates the need to remember multiple passwords
Ensures that the same password policy is applied to all resources
Reduces the need for an administrator to manage various accounts on individual resources
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
17
Single Sign-On (SSO)
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
18
Defining the scope for SSO
Configuring user and role-based user access control profiles
Common configurations
Enterprise SSO
Best Practices for Handling Access Controls
Discover and identify all data on the network
Develop policies based on risk associated with data
Place appropriate access controls on data based on risk level
Continuously monitor and test policies and access controls
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
19
Summary
User types and potential access considerations
Multifactor authentication
Enhanced login security
Authentication best practices
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
20
Virtual Lab
Configuring Linux File System Permissions
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
If your educational institution included the Jones & Bartlett labs as part of the course curriculum, use this script to introduce the lab:
"In this lesson, you learned how understanding the significance, or risk levels, associated with the information within an enterprise helps the security administrator determine the correct access levels to those working within the network. The higher the risk of an attacker seeing or removing information, the more constraints the enterprise will put on its users.
In the lab for this lesson, you will first create several new directories to accommodate files associated with a college class. Then you will change directory ownership and modify permissions on those same directories, and change group ownership and modify permissions of the directories. These tasks will help you understand how to create directories on a Linux virtual machine and manage the permissions assigned to file owners, group owners, and other system users."
3/30/2015
21
