Access Control and Authentication Principles

Module 6: Security Technology: Access Controls, Firewalls, and VPNs

• Access control is a selective method for systems to specify who can use a resource and how.
• Technical controls are essential in enforcing policy for IT functions not directly managed by humans.
• Well-implemented technical controls improve balance between accessibility and confidentiality/integrity.
• Access controls focus on permissions/privileges for subjects (users/systems) on objects (resources).
• Access control includes consideration of when, how, and from where a subject can access an object, and the ways a subject uses it.
• Mandatory Access Controls (MACs) require structured data classification schemes that prioritize each information collection and user.
• Discretionary Access Controls (DACs) are implemented at the discretion of the data user.
• Nondiscretionary controls are implemented by a central authority.

Access Control Approaches

• Access control relies on four mechanisms:
  • Identification: user claiming an identity
  • Authentication: proving user identity
  • Authorization: defining allowable actions with the system
  • Accountability: tracking and monitoring user actions

Identification

• Identification validates and verifies an unauthenticated entity.
• Identifiers can be composite, combining elements like department codes, random numbers, or special characters, for uniqueness.
• Most organizations use a single, unique identifier like a full name or initials and surname.

Authentication

• Authentication validates and verifies claimed identity.
• Authentication factors include:
  • Something you know (DOB, place of birth, SSN, password)
  • Something you have (token, physical key)
  • Something you are (biometrics)

Authorization

• Authorization matches an authenticated entity to a list of assets and their access levels
• Authorization can be handled by:
  • Individual user
  • User group
  • Multiple systems

Accountability

• Accountability (auditability) ensures actions are assigned to a verified identity.
• This is usually accomplished through system logs and database journals.
• Logs record, and log entries have multi-purposes.
• Logs, system/database journals can and are commonly used as audit trails.

Biometrics

• Biometrics authenticate identity using measurable human traits.
• Accurate biometrics include fingerprints, retina, iris, and DNA.
• Biometric systems are often evaluated by false rejection rate, false acceptance rate, and crossover error rate.
• Some users find highly reliable biometric systems intrusive.

Firewall Technologies

• A firewall is a combination of hardware and software that controls information flow between trusted and untrusted networks.
• A firewall might:
  • Separate computer system
  • Utilize software on existing router/server
  • Utilize separate network with supporting devices

Firewalls Processing Modes

• Firewalls use various processing modes:
  • Packet filtering through data packet headers
  • Application-layer proxy through higher layer protocols (and cache services)
  • MAC layer firewalls using MAC addresses
  • Hybrid models using several criteria

Packet-Filtering Firewalls

• Packet-filtering firewalls examine packet header information based on several criteria, such as:
  • IP source and destination addresses
  • Direction (inbound or outbound)
  • TCP/UDP port numbers
• Simple models enforce rules blocking packets based on their addresses.

Access Control Architecture Models

• Models like TCSEC's Trusted Computing Base (TCB), used in pre-2005 DoD Rainbow Series security policy enforcement, help quickly implement or adapt access control strategies.
• Challenges of covert channels, storage channels, and timing channels must be considered.
• Other models, like ITSEC (International Standards for evaluating computer security), the Common Criteria (considered successor to TCSEC and ITSEC), Bell-LaPadula, Biba Integrity Model, Clark-Wilson, Graham-Denning, and Harrison-Ruzzo-Ullman are security models, or access control schemes having unique purposes.

Firewall Architectures

• Firewalls can be configured in several arrangements, including single bastion hosts, screened hosts, and screened subnets(with DMZs).
• Architectural decisions should consider network objectives, organizational capabilities, and available budget.

VPNs

• Virtual Private Networks (VPNs) create a private communication pathway between networked systems.
• Securely accessing internal network resources from remote locations via VPNs.
• VPN implementations exist via Trusted, Secure, and/or Hybrid VPNs.

VPN Functionality

• VPNs use encryption, encapsulation, and authentication functions to create secure connections.
• VPNs use mechanisms such as encapsulation, encryption, authentication to turn public network into private networks
• Common types of VPNs include transport mode VPNs and tunnel mode VPNs.

Content Filters

• Content filters are software programs or appliances that restrict content entering or leaving a network.
• Content filters focus on scripts or programs that limit access to specific protocols/internet locations.
• Content Filters mainly used for internal access restriction to external materials and preventing/filtering incoming spam.

Additional Information regarding Specific Topics

• Knowledge check activity questions for firewalls/access control
• Various Firewall Rule Sets are included (Rule Set 1 - Rule Set 8).
• Well-known Port Numbers are listed
• External/Internal Filtering Firewall Rule Sets
• Access Control Considerations with COVID-19