Untitled Quiz

Chapter 4: Access Control

• NISTIR 7298 defines access control as the process of granting or denying specific requests to obtain and use information and related information processing services, and to enter specific physical facilities.
• RFC 4949 defines access control as a process that regulates system resource use according to a security policy, allowing only authorized entities (users, programs, processes, or other systems) to access these resources.
• Access Control Security Requirements (SP 800-171) includes basic requirements for limiting system access to authorized users, processes acting on their behalf, and devices. These also include limiting transactions and functions authorized users can execute.
• Derived security requirements include controlling sensitive information flow, separating individual duties to mitigate malicious activity, and employing the least privilege principle for all security functions/accounts and non-security functions using non-privileged accounts or roles.
• Other requirements include limiting failed log-in attempts and providing privacy & security notices aligned with sensitive information rules. Maintaining session locks with pattern hiding to prevent access after periods of inactivity, automatically terminating inactive sessions, monitoring remote access sessions, encrypting remote access sessions, routing remote access through managed control points, and authorizing remote privileged commands/access to security-relevant information and wireless access.
• Protecting wireless access with authentication and encryption, controlling mobile device connections, encrypting controlled unclassified information on mobile devices, verifying and controlling external system connections and use of portable storage on external systems, and controlling controlled unclassified information posted or processed on publicly accessible systems.
• Computer security, in general, is concerned with access control. RFC 4949 describes computer security as measures assuring security services in a computer system, specifically those ensuring access control service.
• The Access Control diagram shows the relationship between security administrator, user, and system resources, incorporating authentication and authorization functions and auditing.
• Access Control Policies include DAC (Discretionary Access Control) based on the identity and access rules of the requester. This method includes authorizations that define what requestors are permitted to do.
• MAC (Mandatory Access Control) controls access by comparing security labels with security clearances.
• RBAC (Role-Based Access Control) grants access based on user roles and system rules for user access in given roles.
• ABAC (Attribute-Based Access Control) uses conditions based on object and subject properties.
• Subjects in a system are active entities that cause information to flow among objects, changing the system's state.
• Objects are passive entities that contain or receive information.
• Access rights describe how subjects can access objects (e.g., read, write, execute, delete, create, search).
• DAC operates with access matrices. One dimension lists subjects. The second dimension lists objects. The matrix entry specifies the access rights for a particular subject for a specific object.
• UNIX files use inodes (index nodes) to manage control structures for particular files. One inode can reference several file names. File attributes (permissions, etc.) are stored in the inode. Inodes are stored in an inode table.
• Directories are structured hierarchically and contain file names and pointers to inodes.
• UNIX users have unique user IDs (UIDs) and belong to a primary group identified by a group ID.
• Protection bits are part of the file's inode, specifying read, write, and execute permissions for the owner, group, and others.
• Traditional UNIX uses a minimal access control list (ACL), allowing any number of users/groups to be associated with a file. Files don't inherently require an ACL. An extended ACL indicates that the file has an extended ACL.
• Modern UNIX systems support ACLs. When a process asks for access to an object, it first checks the appropriate ACL. If the ACL entry grants the permission, access is permitted; otherwise, it's denied.
• Mandatory Access Control (MAC) is based on comparing security labels to security clearances.
• Bell-LaPadula (BLP) model ensures that high-classified data is not accessible to users with lower security clearance (avoid data downgrades), via a hierarchy of security classes.
• Multilevel Security (MLS) defines multiple data categories/levels. Data properties define simple security and write-down restrictions.
• DAC includes ds-property. An individual may grant access based on owner discretion, constrained by MAC rules.
• MAC models (e.g., Multics, SELinux, AppArmor, Fedora/Red Hat) have limitations regarding object downgrades and configuration challenges.
• Mandatory Integrity Control (MIC) is a variant of MAC concentrating on processing integrity levels within a login session, and restricting app permissions for the same user.
• RBAC (Role-Based Access Control) models manage access based on roles and constraints. Relationships exist between users, roles, and resources. Role hierarchies can exist, using methods of mutually exclusive roles, access permission for one role in a set, and cardinality/limitations. Prerequisites for a role assignment are common.
• ABAC (Attribute-Based Access Control) defines authorizations based on attributes of subjects (users), objects (resources), and the environment. It offers high flexibility. Web services and cloud services have shown interest in adapting ABAC. The ABAC model uses subject, object, and environmental attributes to evaluate access requests, based on access control rules.
• ICAM (Identity, Credential, and Access Management) is a comprehensive U.S. government-developed strategy for managing and implementing digital identities, credentials, and access control. ICAM prioritizes establishing trustworthy digital representations of individuals and non-person entities (NPEs).
• Credential management factors include enrollment, background checks, credential lifecycle management, and provisioning/deprovisioning processes, policies, and procedures to protect personal identity information and grant access to it.
• Access management is the control of access for various resources, internally or externally. It ensures proper identity verification before access to secure buildings, systems, or data.
• Three support elements are needed for access control: resource management for roles, privilege management, and policy management.
• Identity Federation is used for digital identity management and authentication when individuals from other organizations require access. Open Identity Trust Framework uses standards, technology, policies, and processes for trust and exchange of information across multiple organizations.