Chapter 3: Authorization and Access Control Flashcards
enables us to determine, what the party in question are allowed to do (after identification and authentication
Authorization
when only the bare minimum of access to a party is allowed to ensure that it is able to perform the functionality needed of it
Principle of Least Privilege
giving particular people or set of people access to a given resource
Allowing Access
opposite of allowing access
Denying Access
allowing some access to resources, but only to a certain extent
Limiting Access
taking the access of resources away
Revoking Access
Allowing Access
Limiting Access
Denying Access
Revoking Access
Access Control
referred to as “ackles”. Controls access in the file systems on the operating system or controls the flow traffic in the networks
ACL (Access Control List)
mostly uses three permissions: read, write, and execute
File system ACLs
IP, MAC, and ports
Network ACLs
define the permissions based on a giving resource, an identity and a set of permissions
ACLs
oriented around the use of a token that controls our access
Capability-based security
based entirely on possession of the token ,and not who possesses it
Capability based security
attack common in systems that use ACLs
Confused Deputy Problem
when the software with access to a resource has a greater level of permission to access the resource that the user who is controlling the software
Confused Deputy Problem
attacks that take advantage of weaknesses in applications that are running on the computer being operated directly by the user
client-side attacks
misuses the authority of the browser on the user’s computer
CSRF(cross site request forgery)
also known as user interface redressing, that takes advantage of some of the page rendering features (new Web browser)
clickjacking
is a model of access control based on access being determined by the owner of the resource
Discretionary access control
is a model of access control in which the owner of the resource does not get to decide who gets to access it, but instead access is decided by a group or individual who has the authority to set access on resources
Mandatory Access Control
a model of access control that is similar to MAC, however this form of the access control is based on the role the individual being granted access is performing
Role-base access control
is logically based on attribute, particular person, resource or of an environment
attribute-based access control (ABAC)
used when other access control models are not adequate
multilevel access control
a model that uses a combination of DAC and MAC and is primarily concerned with the confidentiality of the resource in question
Bell-LaPadula Model
How interact MAC and DAC when implemented together?
MAC takes precedence over
DAC, and DAC works within the access allowed by MAC permissions
the level of access granted to an individual must be at least as high as the classification of the resource in order for the individual to be able to access it
the simple security property/no read up (Bell-LaPadula)
anyone accessing a resource can only write its contents to one classified at the same level or higher
the * property axiom/ no write down(Bell-LaPadula)
model of access control is primarily concerned with protecting the integrity of data, even at the expense of confidentiality
Biba Model
the level of access granted to an individual must be no lower than the classification of the resource
the simple integrity axiom/no read down (Biba Model)
Anyone accessing a resource can only write its contents to one classified at the same level or lower
the * integrity axiom/no write up (Biba Model)
an access control model designed to prevent conflicts of interest. Commonly used in industries that handle sensitive data
the Brewer and Nash Model/Chinese Wall
consists of three main classes : objects, company groups, and conflict classes
The Brewer and Nash model
resources such as files or information, pertaining to a single organization
objects (Brewer and Nash)
all objects pertaining to a particular organization
Company groups (Nash and Brewer)
all groups of objects that concern competing parties
conflict classes(Nash and Brewer)
concerned with controlling the access of individuals and vehicles
Physical Access Controls
the simple security property
no read up
the *property axiom
no write down
the simply integrity axiom
no read down
the *integrity axiom
no write up
the simple security property is part of what model
Bell-Lapadula
the *property axiom is part of what model
Bell-LaPadula
the simple integrity axiom is part of what model
Biba Model
the *integrity axiom is part of what model
Biba Model
Bell-LaPadula Model
write up, read down (WURD)
Bell-LaPadula
read up, write down (RUWD)
