Implimenting Access Controls Flashcards
Mandatory access Control
Government entity or company controls how their data is shared.
Ex: hospital owns patient records and limits their sharing
How is Mandatory Access Control normally used
Has a central authority that maintains access control and sets the rules
Used in secure systems government and military or private sectors
Give an example of MAC system
Hospitals
Regulated by hippa
Define Non-discretionary Access Control
The administration has ownership of a resource and decides how it can be shared. User has no rights
Give example of the model discretionary access control
User creating a file and allowing other users or subjects to access that file.
Define Discretionary Access Control policy
Users are granted access based on predefined role user has.
Owner / creator of a file assigns permission to user or subject to access their resource **however access rights are based on rules set by the administrator. **
- users can be organized in groups
- permission will be assigned to a resource for that specific group
- Not centrally managed
Define Role based access control
Access rights are defined through roll you have in your organization, Administrator determines what time of rights user has
Systems that use role based: Windows
Define Rule Based Access Control (RBAC)
Access is determined through system enforced rules or list of conditions
Ex: firewalls - lab network can only be accessed between 9am-6pm
Setting a rule that only chrom based browsers can be used to fill out a web based app
What is Data Base Security
When a database has their own access control. May support data encryption
Define role based Hirrarchies
A way of organizing roles to respect authority, responsibility, and competency
Subject to organizational policies or constraints.
Explain Constrained User Interface (CUI)
A methodology that restricts the users actions of specific functions by not allowing the user to request functions that are outside of his/her respective level of privileged role
How can we use CUI to deny or allow access to system function based on user authentication and capabilities/rights.
Menu and shells
Database views
Physically constraining a user interface
Content dependent access control
Protects databases containing sensitive information
Permits or denies access based on the explicit content
Define Context based access control
Used in firewall applications to extend the firewall decision making process to
Decision based on state
Application later protocol session information
When would temporal isolation methodology be used?
Used to enhance role based access control
Bank access codes in vaults
____A human user or NPE, such as a device that issues access requests to perform operations on objects
Subject
_____A system resource for which access is managed by ABAC system. Such as devices, files, records, tables, process, programs, networks, or domain containing or receiving information
Object
The representation of rules or relationships that makes it possible to determine if a requested access should be allowed
Policy
___are the characteristics of the subject, object, or environment conditions.
Attributes
What is view based access control
Separates A given access control object into sub components and permits or denies access to view or interact with specific sub components
Attribute based access control
Subject request to perform operations on objects granted or denied based on assign attributes of the subject assign attributes of the object environment conditions and a set of policies
Separation of duties
No single individual should perform a task from beginning to end
Explain the Bell-LaPadula Confidentiality Model
Confidentiality model: a given user can read data at a lower sensitivity level But not those at a higher classification level.
Biba integrity model
Looks at how the data is being manipulated to ensure integrity of the information.
subject cannot read down an object at a lower integrity level
Define Clark-Wilson integrity models
Normally forms an access triple
of authenticated principles
programs acting on data
And the data items in them selves
- each triple or relation between user transaction and data item must be maintained in the system
What are three integrity goals
- Authentication prevents authorized users from making modifications on the system
- Controls prevent authorize users from making improper modifications or other actions
- Maintains internal and external consistency through the use of well-formed transactions
Brewer and bash model -Chinese wall
Uses RBAC
Defines a wall to segment data types and developed a set of rules that ensure that no subject accesses o Jeff’s on the other side of the wall
Supports separation of duties
Graham denning model and what are their 8 protection rights
Primarily concerned with
- how Subjects and objects are securely created
- how subjects are assigned rights of privileges
- how ownership of objects is managed
- how objects and subjects can be securely deleted
8 protection rights
- Create object
- create subject
- Delete object
- delete Subject
- read access rights
- grant access right
- delete access right
- transfer access right
