access control Flashcards
access control
a collection of mechanisms that work together to create security architecture to protect the assets of an information system
security policy
states who is allowed to do what
what are some examples of objects
file
directory
data
service
authorisation
checks whether a request for an object can be granted
the act of setting the security policy
reference monitor
the guard enforcing the policy
access control list
attached to each object in a system
accountability
a security goal that allows actions of an entity to be tracked back to that entity
what are some benefits of accountability
can investigate parties involved in a breach
can check whether an organisation is following regulations
allows for deterrence, fault isolation, intrusion detection and prevention
physical access control
using locks security guards badges etc to control people/vehicles entering a protected area via authentication and authorisation
prevents gaining physical access into the system
information/asset owner
responsible for who uses the system and how to recover it in a disaster
logical access control
prevents logical (usually remote) access via the validation of a users identity
confidentiality in CIA
protect data and personal privacy from leakage
integrity in CIA
ensure accuracy completeness consistency and validity of the organisations or a persons data
availability in CIA
data should be available when requested
in which four ways can we allocate privileges
mandatory access control
discretionary access control
the least privilege
role based access control
mandatory access control
the security policy is centrally controlled by a policy/security administrator therefore the rules are set by the system and enforced for all users
what is access based on in mandatory access control
subjects objects and labels
subjects in mandatory access control
people or other systems that are granted clearance
objects in mandatory access control
assets being protected
labels in mandatory access control
binds the object to the subject
defines whether a subject can access an object based on the labels classification
discretionary access control
decentralised
allows the object owner to grant permissions to other users
what does the access control list contain in discretionary access control
user id file names and permissions
what are some examples of permissions
read
write
update
delete
rename
execute
the least privilege
giving people the least amount of access required to do their job
what is the benefit of using the least privilege
lesser risk of leaking data and compromising the integrity
role based access control
each user is assigned to a group then assigning access control rights to each group
benefits of role based access control
good for high number of employees and frequently changing roles
stops a single user from becoming too powerful
what must we do before handing over privileges
check identity and the handover phase must be secure
how do we record privileges
using logs
why do we monitor access
helps notice abnormal behaviour
users may become malicious via malware on their device
collect data for security incidents
identification and authentication mechanisms may be vulnerable
users may want to extend privileges illegally
why do we monitor password systems
evidence of password experimentation (forgetting it)
evidence of logins when the user is absent
audit policies
define which events will be logged
event logs
used by accountability
attackers may hide their traces by deleting relevant logs but they shouldnt be able to tamper with the evidence already logged
hashing
using a hash function to encrypt plaintext
what are the 2 things that hashing must do
be one way; it can only be solved via brute force
be collision resistant; cybertext shouldnt have duplicates
salting
adding random data to the pw before hashing
the salt is stored with the encrypted data
what are benefits of salting
prevents cracking methods
the same string will hash into different values at different times
users with the same password will have different encrypted passwords stored
brute force attacks
guaranteed to work eventually
must determine the alphabet used as some special characters are excluded from passwords
rainbow table attacks
predocumented lookup table for storing hashes
dictionary attacks
only work if the pw is already in the dictionary
