Computer Security: Principles And Practice (PDF)

Computer Security: Principles and Practice Fifth Edition Chapter 4 Access Control Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Access Control Definitions (1 of 2) NISTIR 7298 defi...

Computer Security: Principles and Practice Fifth Edition Chapter 4 Access Control Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Access Control Definitions (1 of 2) NISTIR 7298 defines access control as: “the process of granting or denying specific requests to (1) obtain and use information and related information processing services and (2) enter specific physical facilities” Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Access Control Definitions (2 of 2) RFC 4949 defines access control as: “a process by which use of system resources is regulated according to a security policy and is permitted only by authorized entities (users, programs, processes, or other systems) according to that policy” Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Table 4.1 (1 of 4) Access Control Security Requirements (SP 800-171) Basic Security Requirements 1. Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). 2. Limit system access to the types of transactions and functions that authorized users are permitted to execute. Derived Security Requirements 3. Control the flow of CUI in accordance with approved authorizations. 4. Separate the duties of individuals to reduce the risk of malevolent activity without collusion. Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Table 4.1 (2 of 4) Access Control Security Requirements (SP 800-171) 5. Employ the principle of least privilege, including for specific security functions and privileged accounts. 6. Use non-privileged accounts or roles when accessing nonsecurity functions. 7. Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. 8. Limit unsuccessful logon attempts. 9. Provide privacy and security notices consistent with applicable CUI rules. Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Table 4.1 (3 of 4) Access Control Security Requirements (SP 800-171) 10. Use session lock with pattern-hiding displays to prevent access and viewing of data after period of inactivity. 11. Terminate (automatically) a user session after a defined condition. 12. Monitor and control remote access sessions. 13. Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. 14. Route remote access via managed access control points. 15. Authorize remote execution of privileged commands and remote access to security-relevant information. 16. Authorize wireless access prior to allowing such connections. Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Table 4.1 (4 of 4) Access Control Security Requirements (SP 800-171) 17. Protect wireless access using authentication and encryption. 18. Control connection of mobile devices. 19. Encrypt CUI on mobile devices and mobile computing platforms. 20. Verify and control/limit connections to and use of external systems. 21. Limit use of portable storage devices on external systems. 22. Control CUI posted or processed on publicly accessible systems. CUI = controlled unclassified information Source: From NI ST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, February 2020 National Institute of Standards and Technology (NI ST), United States Department of Commerce. Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Access Control Principles In a broad sense, all of computer security is concerned with access control RFC 4949 defines computer security as: “measures that implement and assure security services in a computer system, particularly those that assure access control service” Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.1 Relationship among Access Control and Other Security Functions Source: Based on [SAND94]. Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Access Control Policies Discretionary access control (DAC) Role-based access control (RBAC) – Controls access based on the – Controls access based on the identity of the requestor and roles that users have within the on access rules system and on rules stating what (authorizations) stating what accesses are allowed to users in requestors are (or are not) given roles allowed to do Attribute-based access control (ABAC) Mandatory access control (MAC) – Controls access based on – Controls access based on attributes of the user, the comparing security labels with resource to be accessed, and security clearances current environmental conditions Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Subjects, Objects, and Access Rights Subject Object Access right – An entity – A resource to – Describes the way capable of which access in which a subject accessing is controlled may access an objects – Entity used to object – Three classes contain – Could include: ▪ Owner and/or ▪ Read receive ▪ Group ▪ Write information ▪ World ▪ Execute ▪ Delete ▪ Create ▪ Search Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Discretionary Access Control (DAC) Scheme in which an entity may be granted access rights that permit the entity, by its own violation, to enable another entity to access some resource Often provided using an access matrix – One dimension consists of identified subjects that may attempt data access to the resources – The other dimension lists the objects that may be accessed Each entry in the matrix indicates the access rights of a particular subject for a particular object Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.2 (1 of 2) Example of Access Control Structures Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.2 (2 of 2) Example of Access Control Structures Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Table 4.2 Authorization Table for Files in Figure 4.2 Subject Access Mode Object Subject Access Mode Object A Own File 1 C Read File 1 A Read File 1 C Write File 1 A Write File 1 C Read File 2 A Own File 3 C Own File 4 A Read File 3 C Read File 4 A Write File 3 C Write File 4 B Read File 1 B Own File 2 B Read File 2 B Write File 2 B Write File 3 B Read File 4 Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.3 Extended Access Control Matrix Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.4 An Organization of the Access Control Function Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Table 4.3 (1 of 2) Access Control System Commands Rule Commands (by S0 ) left parenthesis by S sub 0 right parenthesis Authorization Operation ìa * ü “a *” in A[S0 , X ] ìa *ü Transfer, a 2 by 1 matrix with column entries as follows. Column 1. alpha asterisk, alpha. to S, X Alpha asterisk, in A left bracket S sub 0, X right bracket store, a 2 by 1 matrix with following row entries, Row 1. alpha asterisk, row 2 alpha. in A left bracket S, X right bracket R1 transfer í ý to S, X store í ý in A[S, X ] îa þ îa þ ìa * ü ‘owner ’ in A[S0 , X ]å ìa * ü grant, a 2 by 1 matrix with following column entries, alpha asterisk, alpha. to S, X Owner, in A left bracket S sub 0, X right bracket a store the 2 by 1 column matrix, Row 1 alpha asterisk, Row 2 alpha in A of left bracket S, X right bracket R2 grant í ý to S, X store í ý in A[S, X ] îa þ îa þ ‘control’ in A[S0 , S ] Control, in A left bracket S sub 0, S right bracket or owner in A left bracket S sub 0, X right bracket R3 delete a from S, X delete alpha from S, X or delete a from A[S, X ] delete alpha from A of left bracket S, X right bracket ‘owner ’ in A[S0 , X ] R4 ‘control’ in A[S0 , S ] w ¬ read S, X w left arrow read S, X or Control, in A left bracket S sub 0, S right bracket or owner in A left bracket S sub 0, X right bracket copy A[S, X ] into w copy A left bracket S, X right bracket into w ‘owner ’ in A[S0 , X ] R5 create object X None add column for X to A; store ‘owner ’ in A[S0 , X ] owner in A left bracket S sub 0, X right bracket Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Table 4.3 (2 of 2) Access Control System Commands Rule Command (by S0 ) left parenthesis by S sub 0 right parenthesis Authorization Operation owner in A of left bracket S sub 0, X right bracket R6 destroy object X ‘owner ’ in A[S0 , X ] delete column for X from A R7 create subject S none add row for S to A; execute create object S; store 'control' in A[S, S ] control in A left bracket S, S right bracket ‘owner ’ in A[S0 , S ] owner in A left bracket S sub 0, S right bracket R8 destroy subject S delete row for S from A; execute destroy object S Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Protection Domains Set of objects together with access rights to those objects More flexibility when associating capabilities with protection domains In terms of the access matrix, a row defines a protection domain User can spawn processes with a subset of the access rights of the user Association between a process and a domain can be static or dynamic In user mode certain areas of memory are protected from use and certain instructions may not be executed In kernel mode privileged instructions may be executed and protected areas of memory may be accessed Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved UNIX File Access Control (1 of 3) UNIX files are administered using inodes (index nodes) – Control structures with key information needed for a particular file – Several file names may be associated with a single inode – An active inode is associated with exactly one file – File attributes, permissions and control information are sorted in the inode – On the disk there is an inode table, or inode list, that contains the inodes of all the files in the file system – When a file is opened its inode is brought into main memory and stored in a memory resident inode table Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved UNIX File Access Control (2 of 3) Directories are structured in a hierarchical tree – May contain files and/or other directories – Contains file names plus pointers to associated inodes Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved UNIX File Access Control (3 of 3) Unique user identification number (user ID) Member of a primary group identified by a group ID Belongs to a specific group 12 protection bits – Specify read, write, and execute permission for the owner of the file, members of the group and all other users The owner ID, group ID, and protection bits are part of the Figure 4.5 UNIX File Access Control file’s inode Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Traditional UNIX File Access Control “Set user ID”(Set UID) “Set group ID”(Set GID) – System temporarily uses rights of the file owner/group in addition to the real user’s rights when making access control decisions – Enables privileged programs to access files/resources not generally accessible Sticky bit – When applied to a directory it specifies that only the owner of any file in the directory can rename, move, or delete that file Superuser – Is exempt from usual access control restrictions – Has systemwide access Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Access Control Lists (ACLs) in UNIX Modern UNIX systems support ACLs – Free BSD, Open BSD, Linux, Solaris FreeBSD – Setfacl command assigns a list of UNIX user IDs and groups – Any number of users and groups can be associated with a file – Read, write, execute protection bits – A file does not need to have an ACL – Includes an additional protection bit that indicates whether the file has an extended ACL When a process requests access to a file system object two steps are performed: – Step 1 selects the most appropriate ACL – Step 2 checks if the matching entry contains sufficient permissions Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.5 UNIX File Access Control Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Mandatory Access Control (1 of 5) A concept that evolved out of requirements for military information security Controls access based on comparing security labels with security clearances Bell-LaPadula (BLP) model – Developed as a formal model for access control that aims to prove that a design satisfies security requirements – Each subject and each object is assigned a security class that forms a strict hierarchy – Applicable in other areas, where information is organized into gross levels and compartments, and users can access certain compartments Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Mandatory Access Control (2 of 5) Security classes control the manner by which a subject may access an object Four access modes: – read – append – write – execute Multilevel security (MLS): – Multiple categories or levels of data are defined – Properties: ▪ No read up: simple security property ▪ No write down: *-property Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Mandatory Access Control (3 of 5) Discretionary access control (DAC) – Includes the ds-property ▪ An individual may grant another individual access to a document based on the owner’s discretion, constrained by the MAC rules Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Mandatory Access Control (4 of 5) Limitations of the BLP model – Cannot manage the “downgrade” of objects – Classification creep MLS/MAC implementations: – Multics operating system: an early implementation of MLS that had superior security features and greater sophistication in the user interface and other areas – SELinux: the NSA’s powerful implementation of MAC for Linux; can be time-consuming to configure and troubleshoot – AppArmor: a partial MAC implementation that restricts specific processes but leaves everything else – Fedora and Red Hat Enterprise Linux: has a policy that restricts specific processes Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Mandatory Access Control (5 of 5) Mandatory Integrity Control (MIC) – A variant of the MAC, but based on a different model to BLP – Adds Integrity Levels to processes running in a login session – Restricts the access permissions of applications running under the same user account Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.6 Users, Roles, and Resources Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.7 Access Control Matrix Representation of RBAC Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.8 A Family of Role-Based Access Control Models Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Table 4.4 Scope RBAC Models Models Hierarchies Constraints RBAC0 R B A C subscript 0 No No R B A C subscript 1 RBAC1 Yes No R B A C subscript 2 RBAC2 No Yes R B A C subscript 3 RBAC3 Yes Yes Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.9 Example of Role Hierarchy Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Constraints - Role Based on Access Control - RBAC Provide a means of adapting RBAC to the specifics of administrative and security policies of an organization A defined relationship among roles or a condition related to roles Types: – Mutually exclusive roles ▪ A user can be assigned to one role in the set (either during a session or statically) ▪ Any permission (access right) can be granted to only one role in the set – Cardinality ▪ Setting a maximum number with respect to roles – Prerequisite roles ▪ Dictates that a user can only be assigned to a particular role if the user is already assigned to some other specified role Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Attribute-Based Access Control (ABAC) Can define authorizations that express conditions on properties of both the resource and the subject Strength is its flexibility and expressive power Main obstacle to its adoption in real systems has been concern about the performance impact of evaluating predicates on both resource and user properties for each access Web services have been pioneering technologies through the introduction of the eXtensible Access Control Markup Language (XAMCL) There is considerable interest in applying the model to cloud services Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved ABAC Model: Attributes Subject attributes – A subject is an active entity that causes information to flow among objects or changes the system state – Attributes define the identity and characteristics of the subject Object attributes – An object (or resource) is a passive information system-related entity containing or receiving information – Objects have attributes that can be leverages to make access control decisions Environment attributes – Describe the operational, technical, and even situational environment or context in which the information access occurs – These attributes have so far been largely ignored in most access control policies Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved ABAC Distinguishable because it controls access to objects by evaluating rules against the attributes of entities, operations, and the environment relevant to a request Relies upon the evaluation of attributes of the subject, attributes of the object, and a formal relationship or access control rule defining the allowable operations for subject-object attribute combinations in a given environment Systems are capable of enforcing DAC, RBAC, and MAC concepts Allows an unlimited number of attributes to be combined to satisfy any access control rule Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.10 ABAC Scenario Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.11 ACL and ABAC Trust Relationships Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved ABAC Policies A policy is a set of rules and relationships that govern allowable behavior within an organization, based on the privileges of subjects and how resources or objects are to be protected under which environment conditions – Typically written from the perspective of the object that needs protecting and the privileges available to subjects Privileges represent the authorized behavior of a subject and are defined by an authority and embodied in a policy – Other terms commonly used instead of privileges are: rights, authorizations, and entitlements Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Identity, Credential, and Access Management (ICAM) A comprehensive approach to managing and implementing digital identities, credentials, and access control Developed by the U.S. government Designed to: – Create trusted digital identity representations of individuals and nonperson entities (NPEs) – Bind those identities to credentials that may serve as a proxy for the individual of NPE in access transactions ▪ A credential is an object or data structure that authoritatively binds an identity to a token possessed and controlled by a subscriber – Use the credentials to provide authorized access to an agency’s resources Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.12 Identity, Credential, and Access Management (ICAM) Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Identity Management (1 of 2) Concerned with assigning attributes to a digital identity and connecting that digital identity to an individual or NPE Goal is to establish a trustworthy digital identity that is independent of a specific application or context Most common approach to access control for applications and programs is to create a digital representation of an identity for the specific use of the application or program Maintenance and protection of the identity itself is treated as secondary to the mission associated with the application Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Identity Management (2 of 2) Final element is lifecycle management which includes: – Mechanisms, policies, and procedures for protecting personal identity information – Controlling access to identity data – Techniques for sharing authoritative identity data with applications that need it – Revocation of an enterprise identity Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Credential Management (1 of 2) The management of the life cycle of the credential – Examples of credentials are smart cards, private/public cryptographic keys, and digital certificates Encompasses five logical components: – An authorized individual sponsors an individual or entity for a credential to establish the need for the credential – The sponsored individual enrolls for the credential ▪ Process typically consists of identity proofing and the capture of biographic and biometric data ▪ This step may also involve incorporating authoritative attribute data, maintained by the identity management component Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Credential Management (2 of 2) – A credential is produced ▪ Depending on the credential type, production may involve encryption, the use of a digital signature, the production of a smart card or other functions – The credential is issued to the individual or NPE – A credential must be maintained over its life cycle ▪ Might include revocation, reissuance/replacement, reenrollment, expiration, personal identification number (PIN) reset, suspension, or reinstatement Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Access Management Deals with the management and control of the ways entities are granted access to resources Covers both logical and physical access May be internal to a system or an external element Purpose is to ensure that the proper identity verification is made when an individual attempts to access a security sensitive building, computer systems, or data Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Three Support Elements Are Needed for an Enterprise-Wide Access Control Facility: Resource management – Concerned with defining rules for a resource that requires access control – Rules would include credential requirements and what user attributes, resource attributes, and environmental conditions are required for access of a given resource for a given function Privilege management – Concerned with establishing and maintaining the entitlement or privilege attributes that comprise an individual’s access profile – These attributes represent features of an individual that can be used as the basis for determining access decisions to both physical and logical resources – Privileges are considered attributes that can be linked to a digital identity Policy management – Governs what is allowable and unallowable in an access transaction Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Identity Federation Term used to describe the technology, standards, policies, and processes that allow an organization to trust digital identities, identity attributes, and credentials created and issued by another organization Addresses two questions: – How do you trust identities of individuals from external organizations who need access to your systems – How do you vouch for identities of individuals in your organization when they need to collaborate with external organizations Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.13 (1 of 2) Identity Information Exchange Approaches Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Open Identity Trust Framework (1 of 2) Open ID – An open standard that allows users to be authenticated by certain cooperating sites using a third-party service OIDF – OpenID Foundation is an international nonprofit organization of individuals and companies committed to enabling, promoting, and protecting OpenID technologies ICF – Information Card Foundation is a nonprofit community of companies and individuals working together to evolve the Information Card ecosystem Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Open Identity Trust Framework (2 of 2) OIT F – Open Identity Trust Framework is a standardized, open specification of a trust framework for identity and attribute exchange, developed jointly by OIDF and ICF OIX – Open Identity Exchange Corporation is an independent, neutral, international provider of certification trust frameworks conforming to the OITF model AXN – Attribute Exchange Network is an online Internet-scale gateway for identity service providers and relying parties to efficiently access user asserted, permissioned, and verified online identity attributes in high volumes at affordable costs Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.13 (2 of 2) Identity Information Exchange Approaches Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Table 4.5 (1 of 3) Functions and Roles for Banking Example (a) Functions and Official Positions Role Function Official Position A financial analyst Clerk B financial analyst Group Manager C financial analyst Head of Division D financial analyst Junior E financial analyst Senior F financial analyst Specialist G financial analyst Assistant... Ellipsis... Ellipsis... Ellipsis X share technician Clerk Y support e-commerce Junior Z office banking Head of Division Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Table 4.5 (2 of 3) Functions and Roles for Banking Example (b) Permission Assignments Role Application Access Right A money market Instruments 1, 2, 3, 4 A derivatives trading 1, 2, 3, 7, 10, 12 A interest instruments 1, 4, 8, 12, 14, 16 B money market instruments 1, 2, 3, 4, 7 B derivatives trading 1, 2, 3, 7, 10, 12, 14 B interest instruments 1, 4, 8, 12, 14, 16 B private consumer instruments 1, 2, 4, 7... Ellipsis... Ellipsis... Ellipsis Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Table 4.5 (3 of 3) Functions and Roles for Banking Example (c) Permission Assignment with Inheritance Role Application Access Right A money market Instruments 1, 2, 3, 4 A derivatives trading 1, 2, 3, 7, 10, 12 A interest instruments 1, 4, 8, 12, 14, 16 B money market instruments 7 B derivatives trading 14 B private consumer instruments 1, 2, 4, 7... Ellipsis... Ellipsis... Ellipsis Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Figure 4.14 Example of Access Control Administration Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Summary (1 of 2) Access control principles Mandatory access control – Access control context – Bell-LaPadula (BLP) – Access control policies model Subjects, objects, and access Role-based access control rights – RBAC reference Discretionary access control models – Access control model Attribute-based access control – Protection domains – Attributes UNIX file access control – ABAC logical – Traditional UNIX file architecture access control – ABAC policies – Access control lists in UNIX Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Summary (2 of 2) Identity, credential, and access management – Identity management – Credential management – Access management – Identity federation Trust frameworks – Traditional identity exchange approach – Open identity trust framework Bank RBAC system Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved Copyright This work is protected by United States copyright laws and is provided solely for the use of instructors in teaching their courses and assessing student learning. Dissemination or sale of any part of this work (including on the World Wide Web) will destroy the integrity of the work and is not permitted. The work and materials from it should never be made available to students except by instructors using the accompanying text in their classes. All recipients of this work are expected to abide by these restrictions and to honor the intended pedagogical purposes and the needs of other instructors who rely on these materials. Copyright © 2024, 2018, 2015 Pearson Education, Inc. All Rights Reserved