Access Control Systems Overview

Access Control Systems

• Access control systems manage subject-object interactions. Subjects are users, processes, or anything needing access. Objects are resources like networks, servers, and files.
• Access Control Lists (ACLs) detail subjects and their permissions on objects.
• Access control systems involve four key processes:
  • Identification: Creating user or process IDs.
  • Authentication: Verifying subject identity.
  • Authorization: Defining and enforcing subject permissions on resources.
  • Accounting: Tracking resource usage.

Least Privilege and Implicit Deny

• Least privilege limits permissions to only what users need for job functions, reducing misuse risk.
• Implicit deny relies on explicit authorization for access, denying any request not explicitly permitted. This model is common in firewall rules.

Authorization Access Models

• Discretionary Access Control (DAC): Resource owners control access, granting permissions to others.
• Role-Based Access Control (RBAC): Uses predefined roles and assigns users to those roles to manage access efficiently.
• Mandatory Access Control (MAC): Uses security clearance levels (labels) for restricted access based on hierarchical trust. A user can only access objects at their clearance level or below.
• Rule-based Access Control: Policies based on system-enforced rules, such as RBAC and MAC, are examples. Continuous authentication (e.g., Windows UAC) adds an extra layer of security by requiring confirmation for privileged actions.

Accounting and Non-repudiation

• Accounting logs user authentication and access, providing an audit trail for authorized and unauthorized actions.
• Logging is part of enforcing non-repudiation (the user cannot deny actions).
• Non-repudiation is established through various mechanisms:
  • Video surveillance
  • Biometrics (strong authentication)
  • Signatures
  • Receipts

User Account Types

• User accounts validate user identity during login.
• Default Windows user accounts:
  • Administrator: Full control, disabled by default, strong password required.
  • Guest: Disabled by default.
  • User Accounts created during setup: Local or Microsoft account, Admin privileges by default.

Group Accounts

• Group accounts simplify administration, assigning permissions to groups and enabling inheritance to users.
• Windows default groups:
  • Administrators: Full control, used sparingly.
  • Standard Users: Basic functions, restricted admin privileges.
• Workgroups have limited group accounts.

Authentication Factors

• Authentication ensures accounts are used only by their proper holders.
• Authentication factors:
  • Something you know (passwords, PINs, etc.)
  • Something you have (smart cards, tokens)
  • Something you are (biometrics)

Password Cracking and Management

• "Something you know" authentication is prone to password attacks.
• Cracking methods:
  • Dictionary attacks (using common words)
  • Brute-force attacks (trying all possible combinations)
• Password best practices:
  • Length (longer is better)
  • Complexity (avoid simple words, blend upper/lowercase)
  • Memorability (use long phrases with symbols)
  • Confidentiality (don't share or write down)
  • History and expiration (change regularly)
  • Avoid reuse (don't use passwords across sites)

Encryption Types

• Encryption hides information using keys.
• Common terminology:
  • Plain text: Unencrypted data
  • Cipher text: Encrypted data
  • Cipher: Encryption/decryption algorithm
• Encryption types:
  • Symmetric (single key for encryption and decryption); security depends on keeping the key secret.
  • Asymmetric (public and private keys); suitable for authentication and key exchange.
  • Cryptographic hashing (creates short, fixed-length data representations for integrity checks)

Public Key Infrastructure (PKI)

• PKI authenticates subjects on public networks using digital certificates (a public key embedded and signed by a Certificate Authority).
• Clients encrypt data using a server's public key for secure transmission.

Digital Signatures

• Digital signatures use private keys to encrypt messages, proving their origin and preventing modification.

Virtual Private Networks (VPNs)

• A VPN creates a secure tunnel through a public network to connect two private networks or a remote host to a local network, employing encryption and authentication.