P1L5: Access Control Flashcards
Two parts to Access Control
- Decide who should have access to certain resources. An access control policy.2. Enforcement–only accesses defined by the access control policy are granted
Access Control Matrix (ACM)
Rows correspond to sources of the request (users/subjects/groups)Columns correspond to the resources that need protected
Discretionary Access Control
Access is at the discretion of its owner. Owner can grant access to other users and also allow or not allow the other users to propagate this access.
Flaw with DAC
Other user can copy to another file and then share with third party.
Access Control List (ACL)
Columns for an object that define each users rights of that object.
Capability List (C-List)
Rows for a user that define that user’s rights for each object.
Where should ACL be stored?
–In trusted part of system–Consists of access control entries–Should be stored along with other object meta-data–Checking requires traversal of the ACL
Where should C-List be stored?
–It is per user–A capability is an unforgeable reference/handle for a resource–User catalogue of capabilities defines what a certain user can access–Can be stored in objects/resources themselves
ACL vs C-List
Efficiency–ACL are not as efficient as C-ListAccountability–Can be found easily in ACL. With C-List, each user’s catalog must be checked to see if access ok.Revocation–Revoking access in ACL is easyMost OS uses ACL
How does OS implement ACL?
The OS keeps track of info about each file and its metadata, called an i-node. Open files are stored in the meta-data table. The file must be active.
Role Based Access Control (RBAC)
The access rights are associated by roles/jobs. Users can have more than one role.
RBAC benefits
–Policy need not be updated when a certain person leaves–new employee should be able to activate the desired role.–Start with minimum accessSELinux supports RBAC
Fail-safe defaults
Implies that when an access control policy is silent about access to a certain user, that access must be denied.
The principal objectives of computer security are to prevent unauthorized users from gaining access to resources, to prevent legitimate users from accessing resources in an unauthorized manner, and to enable legitimate users to access resources in an authorized manner. T/F
True
Security labels indicate which system entities are eligible to access certain resources. T/F
True
A user may belong to multiple groups. T/F
True
An access right describes the way in which a subject may access an object. T/F
True
Any program that is owned by, and SetUID to, the “superuser” potentially grants unrestricted access to the system to any user executing that program. T/F
True
_____ implements a security policy that specifies who or what may have access to each specific system resource and the type of access that is permitted in each instance.
Access Control
What is Access Control?
It implements a security policy that specifies who or what may have access to each specific system resource and the type of access that is permitted in each instance.
What is Authorization?
Authorization is the granting of a right or permission to a system entity to access a system resource.
What is Mandatory Access Control?
Mandatory Access Control controls access based on comparing security labels with security clearances.
What is a Role?
A role is a named job function within the organization that controls this computer system.
What do constraints do?
Constraints provide a means of adapting RBAC to the specifics of administrative and security policies in an organization.
What is Discretionary access control?
Discretionary access control controls access based on the identity of the requestor and on access rules stating what requestors are or not allowed to do.
______ access control controls access based on the identity of the requestor and on access rules stating what requestors are or not allowed to do.
Discretionary
____ access control controls access based on the roles hat users have within the system and on rules stating what accesses are allowed to users in given roles.
Role based
What is Role based access control?
Role based access control controls access based on the roles hat users have within the system and on rules stating what accesses are allowed to users in given roles.
What are the basic elements of Access Control?
Subject
Object
Access Right.
Basic access control systems typically define three classes of subject: owner, _______ and world.
Group
What 3 classes of subject do Basic Access Control Systems define?
Owner
Group
World
What’s the difference between Authentication and Authorization?
Authentication - Verification that the credentials of a user or other system entity are valid
Authorizatoin - The granting of a right or permission to a system entity to access a system resource
What is an Access Control Matrix?
Matrix of who can access what. Subjects in row, objects in column
What is a Capability List?
For every user, objects are listed with their access right for that user. stored in objects themselves
