Access Control (Lecture 8 p2) Flashcards
What is the definition of computer security?
RFC 4949 defines computer security as
‘measures that implement and assure security services in a computer system, particularly those that assure access control service’
Explain access control
Policy: Who+What+How=Y es/No
Person = Who
Mode of access = How
Object = What
What are the goals of Access policies?
Check every access
Enforce least privilege
Verify acceptable usage
Track users’ access
Appropriate granularity
Use audit logging to track accesses
What is Discretionary Access Control (DAC)?
Controls access based on the identity of the requestor and on access rules (authorisations) stating what requesters are (or are not) allowed to do
Scheme in which an entity may enable another entity to access some resource
Often provided using an access matrix (one dimension consists of identified subjects that may attempt data access to the resources and the other dimension lists the objects that may be accessed
Each entry in the matrix indicates the access rights of a particular subject for a particular object
What is Mandatory Access Control (MAC)?
Controls access based on comparing security labels with security clearances
What is Role-based Access Control (RBAC)
Controls access based on the roles that users have within the system and on rules stating what accesses are allowed to users in given roles
What is Attribute-Based Access Control (ABAC)?
Controls access based on the attributes of the user, the resource to be accessed, and the current environmental conditions (where it’s being accessed from)
Explain an Access Control Directory
There is a directory for each user. It lists files, access rights and a file pointer. The files sit independent of the users directory and the file pointer and access rights say what controls you have over it (ORW - owner read write, OX - Owner execute)
Explain an Access Control Matrix
Shows clearly what items you have and what users there are and shows what access each user has to each file
Explain an Access Control List
There is a directory with the files and an access list pointer which points to the Access Lists. The Access Lists is for that particular file and contain the users and what access rights they have. The file itself is separate again
What is a subject?
An entity capable of accessing objects
There are 3 classes: Owner, Group, World
What is an object?
A resource to which access is controlled. An entity used to contain and/or receive information
File, database
What are access rights?
It describes the way in which a subject may access an object and could include
- Read
- Write
- Execute
- Delete
- Create
- Search
What are UNIX files?
UNIX files are administered using inodes (index nodes)
File attributes, permissions and control information are sorted in the inode.
On the disk there is an inode table, or list, that contains the inodes of all the files in the file system
When a file is opened its inode is brought into main memory and stored in a memory resident inode table so it can be accessed quickly
Directories structured in a hierarchical tree. May contain files or other directories
Contains file names plus pointers to associated inodes
Explain UNIX File Access Control
Unique user identification number (user ID)
Member of a primary group identified by a group ID
Belongs to a specific group
12 protection bits
-Specifies read, write, and execute permissions for the owner of the file, members of the group and all other users
From there we get a minimum access control list
