Information Security: CIA Triad and Access Control

• Information security is the practice of protecting information assets.

CIA Triad

• The CIA triad consists of confidentiality, integrity, and availability.
• Confidentiality ensures that information is accessible only to authorized users.
• Integrity maintains the accuracy and completeness of information.
• Availability ensures that authorized users have reliable access to information and resources.

Types of Access Control

• Preventive access control aims to prevent security incidents from occuring.
• Deterrent access controls discourage individuals from attempting to violate security policies.
• Detective access control identifies and records security breaches or incidents that do occur.
• Corrective access control mitigates the impact of security incidents or breaches.
• Recovery access control restores systems and data after a security incident.
• Compensation access controls provide alternatives when primary controls fail.
• Directive access control provides mandatory rules or polices
• Administrative access controls are the policies and procedures for managing user access and permissions.
• Logical/technical access controls are hardware and software mechanisms used to manage access control.
• Physical access controls are tangible security measures like locks, fences, and security guards.

Access Control in a Layered Environment

• Layered security, also known as defense in depth, involves the deployment of multiple access control layers.

The Process of Accountability

• Identification is the process of uniquely identifying a user or entity.
• Authentication verifies the identity of a user or entity.
• Type 1 authentication factor is something you know, such as a password.
• Type 2 authentication factor is something you have, such as a smart card.
• Type 3 authentication factor is something you are, commonly biometrics.
• Multi factor authentication uses two or more authentication factors
• Authorization determines what actions, resources, or data an authenticated user can access.

Auditing and Accountability

• Auditing tracks and records online activities of user accounts and processes.
• Audit trails compared with authorization against authenticated accounts ensure accountability.

Identification and Authentication Techniques

• Passwords can be static or dynamic.
• Static passwords remain constant until changed by the user.
• Dynamic passwords change periodically or with each use.

Password Security

• One-way encryption is the strongest method for password storage.
• Passwords should not be transmitted in clear text or with weak encryption.
• Password verification and cracking tools should be used to identify weak passwords.
• Idle user accounts should be disabled after short periods of inactivity.
• Users should be required to change passwords regularly.
• Passwords should not be displayed in clear form on any screen.
• Longer passwords, 16+ characters are better.
• A list of passwords to avoid should be made available to users.

Biometrics

• Common biometric methods include fingerprints, face scans, retina scans, iris scans, palm scans, hand geometry, heart/pulse patterns, voice recognition, and signature dynamics.

Tokens

• Static tokens are fixed and do not change.
• Synchronous dynamic password tokens generate time-based passwords.
• Asynchronous dynamic password tokens require a challenge and response.
• Challenge-response tokens require users to respond to a challenge from the system.

Tickets

• Single Sign-On (SSO) allows users to access multiple applications with one set of credentials.

Kerberos

• Kerberos is a SSO protocol
• In the Kerberos logon process, a user types a username and password into the client.
• The client encrypts these credentials with AES for transmission to the Key Distribution Center (KDC).
• The KDC verifies the user credentials and generates a Ticket Granting Ticket (TGT) by hashing the user's password.
• The TGT is encrypted with AES and sent to the client.
• The client installs the TGT for use until it expires.

Kerberos Server Access

• The client sends the TGT back to the KDC with a request for server access.
• The KDC verifies the TGT and ensures the user has access privileges.
• A service ticket (ST) is generated and sent to the client.
• The client sends the ST to the server or service host.
• The server/host verifies the ST validity with the KDC.
• Identity and authorization are verified so Kerberos activity is complete.
• The server opens a session and begins communications with the client.

Limitations of Kerberos

• Kerberos is susceptible to dictionary and brute-force attacks.
• Tickets are stored in memory on the client and server
• Captured tickets can be replayed if reused within their lifetime.
• Tickets are based on user's password hash with a timestamp.
• Kerberos only encrypts authentication traffic.

Other Ticket Systems

• Other ticket systems include SESAME (Secure European System for Applications in a Multivendor Environment), KryptoKnight(IBM), NetSP, and Thin clients(ex. DameWare).
• Directory services such as Microsoft’s Active Directory and Novell’s NetWare Directory Services (NDS) are also used.
• Scripted access or logon scripts can control access.

Access Control Techniques

• Discretionary access control allows data owners to grant or deny access to resources.
• Nondiscretionary access control implements access restrictions based on predefined rules.
• Mandatory access control assigns security labels/classifications to resources.
• Role-based access control grants access based on a user's role within an organization.
• Task-based access control grants access based on the tasks a user needs to perform.

Mandatory Access Controls

• Common security labels include top secret, secret, confidential, sensitive but unclassified (SBU), and unclassified.

Mandatory Access Control Types

• Hierarchical environments have a clear chain of command and access levels.
• Compartmentalized environments segregate information into isolated compartments.
• Hybrid environments combine aspects of hierarchical and compartmentalized models.

Access Control Methodologies and Implementation

• Centralized access control uses a central server to authenticate and authorize users.
• Remote Authentication Dial-In User Service (RADIUS) provides centralized authentication.
• Terminal Access Controller Access Control System (TACACS) is similar to RADIUS for network access control.
• Decentralized access control distributes access management functions across multiple systems.

Account Administration

• Account administration tasks include creating new accounts, account maintenance, monitoring of logs and journals, managing access rights and permissions, and implementing the principle of least privilege.
• Need-to-know access limits access to only the information required for a specific job.
• Separation of duties divides responsibilities to prevent fraud and errors.