Access Control: Lecture 2

Question 1

Authentication Methods

Answer 1

1) Knowledge (What you know, passwords):

2) Possession (What you have):
+ eTokens

\+ Smart Cards
- JavaCard
cheaper and more popular but less secure
- MULTOS
more secured (government agencies)

+ RFID Tags
Vulnerabilities: Side Channel, MITM, Sniffing

3) Biometric (What you are):

Question 2

Essential Requirements of Characteristic as a Biometric

Answer 2

1) Universality
2) Distinctiveness
3) Permanence
4) Collectability

Question 3

Acceptability

Answer 3

Need to see if staff willing to accept it if implemented

Question 4

Accuracy

Answer 4

Preferably False Accept Rate (ideally 0), True Accept Rate (ideally 1), but this is not possible as TAR increase we will get some FAR increase as well.

Question 5

Budget (Cost)

Answer 5

Do we have enough money to implement it?

Question 6

Types of Biometric

Answer 6

1) Iris Scanning
- 256 unique characteristics
- More accurate than fingerprint but less than retinal scanning
- More costly than fingerprint but reducing
- Easy and fast enrollment

2) Retinal Scanning
- 400 unique characteristics
- Even more accurate
- Very expensive
- Longer registration due to increase number of characteristics (3x as long as iris)
- Can change due to some diseases

3) Fingerprint Scanning
- Cheapest but least accurate
- Easy to enroll
- Quite permanent but affect by dryness or injures etc.
- Quite universal

4) Facial Recognition
- More expensive than fingerprints
- Fairly accurate, more accurate than fingerprints but might not be for iris and retinal
- Easy to enroll
- Physical characteristics can change over time

Question 7

Pros & Cons

Answer 7

Passwords:

1) Pros
- Cheap
2) Cons
-

Tokens:

1) Pros
- Cheap
2) Cons
- Expensive to scale up

Biometric:

1) Pros
- Unique data harder to crack
- Fast, convenient authentication
- Scalable
2) Cons:
- Unrecoverable if compromised
- New and expensive
- Privacy concerns

Question 8

Authorisation

Answer 8

Principle of Least Privilege (POLP):
System Administrators will require inputs from management to know what access rights they need.

1) Discretionary Access Control:
Assigns access rights based on rules specified by users (eg. rw-)

2) Role Based Access Control:
Divides users into roles and given access rights accordingly (addresses the principle of least privilege)

3) Mandatory Access Control (Probably most secured):
Assign labels to actors users and objects, assign levels to resources, services and users.