Untitled Quiz

Computer Security (IS-820) - Access Control

• Access control is defined as the process of granting or denying specific requests to obtain and use information and related processing services, and to enter specific physical facilities.
• NIST-IR 7298 (May 2013) defines access control in this way.
• RFC 4949 defines access control as a process by which system resource use is regulated according to a security policy, permitting use only by authorized entities (users, programs, processes, or other systems).
• Computer security is fundamentally concerned with access control.
• RFC 4949 defines computer security as measures that assure security services in a computer system, especially those assuring access control service.

Basic Security Requirements

• Limit information system access to authorized users, processes acting on their behalf, or devices.
• Limit system access to authorized transactions and functions.
• Control the flow of sensitive information (CUI) according to approved authorizations.
• Separate individual duties to limit malicious activity without collusion.
• Employ the principle of least privilege, especially for security functions and privileged accounts.
• Use non-privileged accounts when performing non-security functions.
• Prevent non-privileged users from executing privileged functions and audit such executions.
• Limit unsuccessful login attempts and provide privacy notices.
• Employ session locks with pattern-hiding to prevent data viewing after inactivity.
• Automatically terminate sessions after defined conditions.
• Control and monitor remote access sessions.
• Cryptographically secure remote access sessions.
• Route remote access through managed points.
• Authorize remote execution of privileged commands and security-relevant information access.
• Authorize wireless access before allowing connections.
• Protect wireless access with authentication and encryption.
• Control mobile device connections.
• Encrypt sensitive information on mobile devices.
• Verify and limit external system connections.
• Limit the use of organizational portable storage on external systems.
• Control CUI on publicly accessible systems.

Access Control Definitions

• SP 800-171 Access Control Security Requirements

Access Control Principles

• Access control is a broad concept encompassing all computer security concerns.

Access Control and Security Functions

• Authentication: Verifying user or entity credentials
• Authorization: Granting access rights
• Audit: Independent review for system control adequacy, compliance, breach detection, and change recommendations

Classes of Access Control

• Owner: The creator or administrator of the resource, potentially a system administrator or project leader for system or project-specific resources.
• Group: Groups of users with granted rights, allowing access based on group membership.
• World: Users able to access the system, but lacking owner or group access rights.

Access Rights

• Read: Viewing data (records, fields, files).
• Write: Adding, modifying, or deleting data within resources. Includes read access.
• Execute: Running programs.
• Delete: Removing files/records.
• Create: Producing new files/records/fields.
• Search: Listing or locating resources within a directory.

Subjects, Objects, and Access Rights

• Subject: An entity capable of accessing objects. Three classes: owner, group, world.
• Object: A resource with controlled access.
• Access right: Specifies how a subject accesses the object and may include 'Read', 'Write', 'Execute', 'Delete', 'Create', and 'Search'.

Access Control Policies

• DAC (Discretionary Access Control): Access control based on the identity of a requestor and on access rules and authorizations. It specifies what the requestor is allowed to do.
• MAC (Mandatory Access Control): Access control based on comparing security labels with security clearances.
• RBAC (Role-Based Access Control): Access control based on roles, rules defining allowed actions for users within those roles.
• ABAC (Attribute-Based Access Control): Access control based on user attributes, resource attributes, and current environmental conditions.

Discretionary Access Control (DAC)

• An entity is granted access by another - enabling other entities access.
• Uses an access matrix for subject access.
• Implementation often uses Access Control Lists (ACLs) or Capability Lists.
• Usually operates by associating an ACL with each object (file), and that ACL lists the subjects and their access rights.
• A capability list for each subject will list what objects and associated rights the subject has.

Access Control Matrix, ACLs & Capability Lists

• Access control matrices are often too broad to maintain directly. ACLs and capability lists are alternatives.
• ACL (Access Control List): List of subjects, access rights associated with each object; often used in practice instead of a matrix.
• Capability List: A list of objects and access rights for a subject. This is stored in the subject's records.

An Access Control Model

• Assumes subjects, objects, and rules governing subject access.
• A protection state describes the access rights at any given time.
• Must be able to represent, enforce, and allow subjects to modify the state.
• Objects that need control: Processes, devices, memory locations.

The Access Control Module

• A separate module manages access to specific objects.
• Each access request triggers steps which result in a message to the object's controller.
• The controller consults the access matrix, granting or denying access based on the rules.

The Access Control Function

• Access to each object is controlled by a controller based on the access matrix and rules.
• Subjects permitted to modify the access matrix.
• Matrix entries are objects, accesses mediated by access matrix controllers, and controllers control updates.

Rules to Modify the Access Control Matrix

• Specific rules govern how the access matrix can be changed.
• This involves commands (e.g., grant, delete) and corresponding authorizations (e.g., owner, control)
• These rules describe operations on the matrix for subject access modification.

Hierarchy of Subjects

• Subjects can be arranged in a hierarchy, possibly using the 'owner' attribute to construct a hierarchy.
• This hierarchical arrangement can be used to establish relationships and grant/revoke access accordingly.