Podcast
Questions and Answers
Which class of access control grants the least amount of access to users who are not included in the owner or group categories?
Which class of access control grants the least amount of access to users who are not included in the owner or group categories?
What is a primary function of access control in computer security?
What is a primary function of access control in computer security?
Which of the following is a responsibility of the owner class in access control?
Which of the following is a responsibility of the owner class in access control?
What is an essential practice for protecting wireless access according to access control principles?
What is an essential practice for protecting wireless access according to access control principles?
Signup and view all the answers
Which action should be avoided when dealing with external information systems?
Which action should be avoided when dealing with external information systems?
Signup and view all the answers
What is the primary goal of access control as defined by NIST-IR 7298?
What is the primary goal of access control as defined by NIST-IR 7298?
Signup and view all the answers
Which requirement ensures that users can only execute functions they are authorized for?
Which requirement ensures that users can only execute functions they are authorized for?
Signup and view all the answers
What does the principle of least privilege entail?
What does the principle of least privilege entail?
Signup and view all the answers
Why is it important to limit unsuccessful logon attempts?
Why is it important to limit unsuccessful logon attempts?
Signup and view all the answers
What does controlling the flow of Controlled Unclassified Information (CUI) require?
What does controlling the flow of Controlled Unclassified Information (CUI) require?
Signup and view all the answers
What should be included in security notices provided to users?
What should be included in security notices provided to users?
Signup and view all the answers
What role do cryptographic mechanisms play in remote access sessions?
What role do cryptographic mechanisms play in remote access sessions?
Signup and view all the answers
What is a key function of session locking in security requirements?
What is a key function of session locking in security requirements?
Signup and view all the answers
What is the primary role of the access matrix controller?
What is the primary role of the access matrix controller?
Signup and view all the answers
Which rule allows a subject to transfer an access right without the copy flag due to security concerns?
Which rule allows a subject to transfer an access right without the copy flag due to security concerns?
Signup and view all the answers
According to Rule R3, what action can a subject S0 perform regarding access rights?
According to Rule R3, what action can a subject S0 perform regarding access rights?
Signup and view all the answers
What permission does Rule R5 grant to any subject?
What permission does Rule R5 grant to any subject?
Signup and view all the answers
What occurs when the owner of an object executes Rule R6?
What occurs when the owner of an object executes Rule R6?
Signup and view all the answers
Which rule allows a subject to read parts of the access matrix it owns or controls?
Which rule allows a subject to read parts of the access matrix it owns or controls?
Signup and view all the answers
What capability does Rule R7 provide a subject?
What capability does Rule R7 provide a subject?
Signup and view all the answers
What is the effect of Rule R8 regarding the access matrix?
What is the effect of Rule R8 regarding the access matrix?
Signup and view all the answers
Which of the following describes a 'Subject' in an access control context?
Which of the following describes a 'Subject' in an access control context?
Signup and view all the answers
What does Role-Based Access Control (RBAC) primarily depend on?
What does Role-Based Access Control (RBAC) primarily depend on?
Signup and view all the answers
In Discretionary Access Control (DAC), what permits an entity to enable another entity to access resources?
In Discretionary Access Control (DAC), what permits an entity to enable another entity to access resources?
Signup and view all the answers
Which of the following access rights is NOT typically included in access control?
Which of the following access rights is NOT typically included in access control?
Signup and view all the answers
What is an access matrix primarily used for in the context of DAC?
What is an access matrix primarily used for in the context of DAC?
Signup and view all the answers
Mandatory Access Control (MAC) works by comparing what type of information?
Mandatory Access Control (MAC) works by comparing what type of information?
Signup and view all the answers
Which dimension is typically NOT part of the DAC access matrix?
Which dimension is typically NOT part of the DAC access matrix?
Signup and view all the answers
Which type of access control relates to attributes of the user and the resources accessed?
Which type of access control relates to attributes of the user and the resources accessed?
Signup and view all the answers
What aspect does 'World' refer to in the context of subjects in access control?
What aspect does 'World' refer to in the context of subjects in access control?
Signup and view all the answers
Which entry type indicates the specific access rights of a particular subject for a particular object?
Which entry type indicates the specific access rights of a particular subject for a particular object?
Signup and view all the answers
What defines the protection state of a system?
What defines the protection state of a system?
Signup and view all the answers
Which of the following is NOT a requirement of a protection state?
Which of the following is NOT a requirement of a protection state?
Signup and view all the answers
In an access control matrix, what does an entry A[S, X] represent?
In an access control matrix, what does an entry A[S, X] represent?
Signup and view all the answers
What is the first step when a subject issues a request to access an object?
What is the first step when a subject issues a request to access an object?
Signup and view all the answers
What happens if an access attempt does not match the access rights specified in the matrix?
What happens if an access attempt does not match the access rights specified in the matrix?
Signup and view all the answers
Which of the following access rights does NOT relate to devices?
Which of the following access rights does NOT relate to devices?
Signup and view all the answers
Which component is responsible for evaluating access requests?
Which component is responsible for evaluating access requests?
Signup and view all the answers
In relation to subjects, what does the ability to alter access rights involve?
In relation to subjects, what does the ability to alter access rights involve?
Signup and view all the answers
Study Notes
Computer Security (IS-820) - Access Control
- Access control is defined as the process of granting or denying specific requests to obtain and use information and related processing services, and to enter specific physical facilities.
- NIST-IR 7298 (May 2013) defines access control in this way.
- RFC 4949 defines access control as a process by which system resource use is regulated according to a security policy, permitting use only by authorized entities (users, programs, processes, or other systems).
- Computer security is fundamentally concerned with access control.
- RFC 4949 defines computer security as measures that assure security services in a computer system, especially those assuring access control service.
Basic Security Requirements
- Limit information system access to authorized users, processes acting on their behalf, or devices.
- Limit system access to authorized transactions and functions.
- Control the flow of sensitive information (CUI) according to approved authorizations.
- Separate individual duties to limit malicious activity without collusion.
- Employ the principle of least privilege, especially for security functions and privileged accounts.
- Use non-privileged accounts when performing non-security functions.
- Prevent non-privileged users from executing privileged functions and audit such executions.
- Limit unsuccessful login attempts and provide privacy notices.
- Employ session locks with pattern-hiding to prevent data viewing after inactivity.
- Automatically terminate sessions after defined conditions.
- Control and monitor remote access sessions.
- Cryptographically secure remote access sessions.
- Route remote access through managed points.
- Authorize remote execution of privileged commands and security-relevant information access.
- Authorize wireless access before allowing connections.
- Protect wireless access with authentication and encryption.
- Control mobile device connections.
- Encrypt sensitive information on mobile devices.
- Verify and limit external system connections.
- Limit the use of organizational portable storage on external systems.
- Control CUI on publicly accessible systems.
Access Control Definitions
- SP 800-171 Access Control Security Requirements
Access Control Principles
- Access control is a broad concept encompassing all computer security concerns.
Access Control and Security Functions
- Authentication: Verifying user or entity credentials
- Authorization: Granting access rights
- Audit: Independent review for system control adequacy, compliance, breach detection, and change recommendations
Classes of Access Control
- Owner: The creator or administrator of the resource, potentially a system administrator or project leader for system or project-specific resources.
- Group: Groups of users with granted rights, allowing access based on group membership.
- World: Users able to access the system, but lacking owner or group access rights.
Access Rights
- Read: Viewing data (records, fields, files).
- Write: Adding, modifying, or deleting data within resources. Includes read access.
- Execute: Running programs.
- Delete: Removing files/records.
- Create: Producing new files/records/fields.
- Search: Listing or locating resources within a directory.
Subjects, Objects, and Access Rights
- Subject: An entity capable of accessing objects. Three classes: owner, group, world.
- Object: A resource with controlled access.
- Access right: Specifies how a subject accesses the object and may include 'Read', 'Write', 'Execute', 'Delete', 'Create', and 'Search'.
Access Control Policies
- DAC (Discretionary Access Control): Access control based on the identity of a requestor and on access rules and authorizations. It specifies what the requestor is allowed to do.
- MAC (Mandatory Access Control): Access control based on comparing security labels with security clearances.
- RBAC (Role-Based Access Control): Access control based on roles, rules defining allowed actions for users within those roles.
- ABAC (Attribute-Based Access Control): Access control based on user attributes, resource attributes, and current environmental conditions.
Discretionary Access Control (DAC)
- An entity is granted access by another - enabling other entities access.
- Uses an access matrix for subject access.
- Implementation often uses Access Control Lists (ACLs) or Capability Lists.
- Usually operates by associating an ACL with each object (file), and that ACL lists the subjects and their access rights.
- A capability list for each subject will list what objects and associated rights the subject has.
Access Control Matrix, ACLs & Capability Lists
- Access control matrices are often too broad to maintain directly. ACLs and capability lists are alternatives.
- ACL (Access Control List): List of subjects, access rights associated with each object; often used in practice instead of a matrix.
- Capability List: A list of objects and access rights for a subject. This is stored in the subject's records.
An Access Control Model
- Assumes subjects, objects, and rules governing subject access.
- A protection state describes the access rights at any given time.
- Must be able to represent, enforce, and allow subjects to modify the state.
- Objects that need control: Processes, devices, memory locations.
The Access Control Module
- A separate module manages access to specific objects.
- Each access request triggers steps which result in a message to the object's controller.
- The controller consults the access matrix, granting or denying access based on the rules.
The Access Control Function
- Access to each object is controlled by a controller based on the access matrix and rules.
- Subjects permitted to modify the access matrix.
- Matrix entries are objects, accesses mediated by access matrix controllers, and controllers control updates.
Rules to Modify the Access Control Matrix
- Specific rules govern how the access matrix can be changed.
- This involves commands (e.g., grant, delete) and corresponding authorizations (e.g., owner, control)
- These rules describe operations on the matrix for subject access modification.
Hierarchy of Subjects
- Subjects can be arranged in a hierarchy, possibly using the 'owner' attribute to construct a hierarchy.
- This hierarchical arrangement can be used to establish relationships and grant/revoke access accordingly.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
