Access Control Flashcards
Authentication
Are you actually who you say you are? This is typically done with passwords, but we have several factors that can (and should) be used for more secure authentication.
Authorization
Are you allowed to do what you are trying to do? Simply, authorization is the process of enforcing policies (i.e., determining what sorts of computing resources a user is allowed to use).
Accounting
What happened and when? Here we measure what resources a user used, how much data was sent, what time it was sent, and more. All of this is done through the logging of data.
AAA Framework
• Identification
—This is who you claim to be
—Usually your username
• Authentication
—Prove you are who you say you are
—Password and other authentication factors
• Authorization
—Based on your identification and authentication, what access do you have?
•Accounting
—Resources used: Login time, data sent and received, logout time
Multi-factor authentication
• More than one factor —Something you are —Something you have —Something you know —Somewhere you are —Something you do • Can be expensive —Separate hardware tokens —Specialized scanning equipment • Can be inexpensive —Free smartphone applications
Something you are
• Biometric authentication —Fingerprint, iris scan, voiceprint • Usually stores a mathematical representation of your biometric —Your actual fingerprint isn't usually saved • Difficult to change —You can change your password —You can't change your fingerprint • Used in very specific situations — Not foolproof
Something you have
• Smart card —Integrates with devices —May require a PIN • USB token —Certificate is on the USB device • Hardware or software tokens —Generates pseudo-random authentication codes •Your phone —SMS a code to your phone
Something you know
• Password —Secret word/phrase, string of characters —Very common authentication factor • PIN —Personal identification number — Not typically contained anywhere on a smart card or ATM card pattern —Complete a series of patterns —Only you know the right format
Somewhere you are
• Provide a factor based on your location
—The transaction only completes
if you are in a particular geography
• IP address
—Not perfect, but can help provide more info
—Works with IPv4, not so much with IPv6
• Mobile device location services
—Geolocation to a very specific area
—Must be in a location that can receive GPS information
or near an identified mobile or 802.11 network
—Still not a perfect identifier of location
Something you do
•A personal way of doing things —You're special • Handwriting analysis —Signature comparison —Writing technique •Typing technique —Delays between keystrokes • Very similar to biometrics —Close to something you are
Federation
• Provide network access to others — Not just employees —Partners, suppliers, customers, etc. •Third-parties can establish a federated network —Authenticate and authorize between the two organizations —Login with your Facebook credentials •The third-parties must establish a trust relationship —And the degree of the trust
Single sign-on (SSO)
•Authenticate one time —Gain access to everything! • Saves time —A seamless process —End-user doesn't see any of the complexities under the surface • Many different methods —Kerberos authentication and authorization — 3rd-party options
Transitive trust
•Trust relationships need to be established early
—Difficult to change once in place
• One-way trust
—Domain B trusts Domain A, Domain A doesn’t trust Domain B
• Two-way trust
—Both domains are peers, both trust each other equally
• Non-transitive trust
—A trust is specifically created and applies only to that domain
• Transitive trust
—Domain A trusts Domain B, Domain B trusts Domain C,
therefore Domain A trusts Domain C
Access control
There are many different way to assign user rights and permissions to files, folders, and other objects.• Authorization
—The process of ensuring only
authorized rights are exercised
• Policy enforcement
—The process of determining rights
• Policy definition
• Users receive rights based on
Access Control models
—Different business needs
or mission requirementsMandatory Access Control (MAC)
•The operating system limits the operation on an object —Based on security clearance levels • Every object gets a label —Confidential, secret, top secret, etc. • Labeling of objects uses predefined rules —The administrator decides who gets access to what security level —Users cannot change these settings
