Chapter 17: Managing Identities and Access Flashcards
access control mechanism
dictates how subjects access objects
reference monitor
abstract machine which mediates all access subjects have to objects: to ensure subjects have necessary access rights and to protect objects from unauthorized access and destructive modification
six main access control models
discretionary, mandatory, role-based, rule-based, attribute-based, risk-based
DAC
discretionary access control
discretionary access control
data owners dictate what subjects have access to files and resources they own
access control lists
bound to objects and indicate what subjects can use them
MAC
mandatory access control
mandatory access control model
uses a security label system
MAC model
users have clearances and resources have security labels with data classifications; MAC system compare these two attributes to determine access control
IFTTT rules
if this, then that
most granular of the access control models
ABAC; Attribute-based access control
XML
Extensible Markup Language
Extensible Markup Language
rules for encoding documents in machine-readable form for interoperability between various web technologies
SPML
Service Provisioning Markup Language
Service Provisioning Markup Language
automation of user management and access entitlement configuration for electronically published services across multiple provisioning systems
SAML
Security Assertion Markup Language; exchange of authentication and authorization data to be shared between security domains
XACML
Extensible Access Control Markup Language
Extensible Access Control Markup Language
declarative access control policy language in XML and a processing model which interprets security policies
OAuth
open standard which allows a user to grant authority to some web resource, like a contacts database, to a third party
OpenID Connect
authentication layer built on OAuth 2.0 protocol which allows transparent authentication and authorization of client resource requests
Kerberos
client/server authentication protocol based on symmetric key cryptography which provides single sign-on (SSO) for distributed environments
KDC
key distribution center; most important component within a Kerberos environment because it holds all users’ and services’ secret keys, provides an authentication service, and securely distributes keys
TGT
ticket granting ticket; Kerberos users receive a TGT, which allows them to request access to resources through the TGS, which generates a new ticket with the session keys
TGS
ticket granting service
weaknesses of Kerberos
KDC is a single point of failure; susceptible to password guessing; session and secret keys are locally stored; KDC needs to always be available; management of secret keys is required
Remote access control technologies
RADIUS, TACACS+, Diameter
identity and access provisioning life cycle
provisioning, access control, compliance, configuration management, and deprovisioning
system account
created by the operating system for use by a particular process, not by a human
service account
system account for a process that runs as a service (i.e. it listens for and responds to requests from other processes)
authorization creep
when a user gains too much access rights and permissions over time
MSAs
managed service accounts; Active Directory domain accounts used by services and provide automatic password management
Role-based access control reduces administrative burdens by …
administrator assigns permissions and rights to a role, and users are plugged into those roles; admin does not need to revoke or reassign permissions to individuals users as they change jobs
challenge/response mechanism
asynchronous token
capability- based access control system
subject (user) has to present an item (ticket, token, or key) which outlines what it can access. capability is tied to the subject for access control purposes
specialized, require extensive administration, expensive, reduce user functionality
MAC (mandatory access control) and multilevel security
ACLs
access control lists; can be modified to provide tighter access control; bound to objects and outline which operations specific subjects can carry out on them
based on symmetric cryptography
Kerberos
SOA
service-oriented architecture
service-oriented architecture
allows team to create a centralized web portal and offer the various services needed by internal and external entities
