Types of Access Controls and Authorization Methods

Study Notes

Types of Access Controls

Discretionary Access Control (DAC)
- Owner decides who can access resources.
- Permissions can be transferred (delegated) to other users.
Mandatory Access Control (MAC)
- Access rights are regulated by a central authority based on multiple levels of security.
- Users cannot change access permissions.
Role-Based Access Control (RBAC)
- Access permissions are assigned based on user roles.
- Simplifies management by grouping users with similar needs.
Attribute-Based Access Control (ABAC)
- Access decisions are made based on user attributes, resource attributes, and environmental conditions.
- More flexible and dynamic than RBAC.

Authorization Methods

Identity-Based Authorization
- Access is granted based on user identity (username/password).
Group-Based Authorization
- Access is granted to users belonging to specific groups (e.g., Admins, Users).
Policy-Based Authorization
- Uses predefined policies to determine access, often found in enterprise environments.
Token-Based Authorization
- Access is granted via tokens (e.g., OAuth, JWT).
- Tokens represent user permissions and are often time-limited.
Kerberos Authentication
- Network authentication protocol that uses tickets to allow nodes to prove their identity securely.

Access Control Models

Bell-LaPadula Model
- Focuses on data confidentiality.
- Implements "no read up, no write down" policy to prevent data leaks.
Biba Model
- Focuses on data integrity.
- Implements "no write up, no read down" policy to prevent data corruption.
Clark-Wilson Model
- Ensures data integrity through well-formed transactions and separation of duties.
- Enforces constraints on data manipulation.
Chinese Wall Model
- Prevents conflicts of interest by restricting access to information based on user’s previous access patterns.
NIST SP 800-162
- Framework for access control systems; emphasizes core concepts like least privilege, need-to-know, and accountability.

These mechanisms ensure that only authorized users gain access to sensitive information and resources, maintaining security and integrity within systems.

Types of Access Controls

Discretionary Access Control (DAC):
- Resource owners have the authority to grant or deny access to others.
- Permissions can be delegated to users by the owner.
Mandatory Access Control (MAC):
- Central authority regulates access permissions based on multi-level security classifications.
- Users lack the ability to alter permissions, ensuring strict control.
Role-Based Access Control (RBAC):
- Access assignments are based on user roles within the organization.
- Simplifies management by categorizing users with similar access needs.
Attribute-Based Access Control (ABAC):
- Decisions on access are made using various user and resource attributes, alongside environmental conditions.
- Provides increased flexibility and adaptability compared to RBAC.

Authorization Methods

Identity-Based Authorization:
- Access determined by user credentials, typically username and password.
Group-Based Authorization:
- Users receive access rights as part of defined groups (e.g., Administrators, General Users).
Policy-Based Authorization:
- Leverages established policies to dictate access; common in corporate environments.
Token-Based Authorization:
- Access granted through tokens (like OAuth or JWT), which signify user permissions and tend to have expiration limits.
Kerberos Authentication:
- Network authentication protocol that uses tickets for secure identity verification among host nodes.

Access Control Models

Bell-LaPadula Model:
- Prioritizes data confidentiality; implements "no read up, no write down" policy to prevent unauthorized information exposure.
Biba Model:
- Focuses on maintaining data integrity; enforces "no write up, no read down" to avoid corrupting data.
Clark-Wilson Model:
- Ensures data integrity through well-structured transactions and separation of duties.
- Establishes strict rules for data manipulation to mitigate errors.
Chinese Wall Model:
- Aims to prevent conflicts of interest by limiting access based on users' previous actions and access history.
NIST SP 800-162:
- Provides a comprehensive framework for access control systems, highlighting principles like least privilege, need-to-know, and accountability.

Summary

Access control mechanisms are essential for safeguarding sensitive data, ensuring only authorized users can interact with critical information.

Description

Explore the various types of access controls such as Discretionary, Mandatory, Role-Based, and Attribute-Based controls. Additionally, learn about authorization methods including Identity-Based and Group-Based authorization. Test your understanding of these crucial concepts in cybersecurity.