Chapter 3: Access Control - Access Control Administration

After a model is chosen, and the techniques and technologies are in place, an organization must decide how they want to administer access. Centralized access control administration is that one individual (rather it be one person or department) has the role of giving access to all of the resources in the organization. A couple of protocols for this that the study guide outlines are listed below.

RADIUS - Remote Authentication Dial-in User Service. A network protocol that authenticates and authorizes on the client/server and keeps a watch on remote users. ISPs use this to allow customers access to the internet. Uses UDP as its transport protocol.

TACACS -  Terminal Access Controller Access Control System. Uses TCP as its transport protocol. Used if more advanced authentication is necessary. One example would be corporate networks.

Chapter 3: Access Control - Access Control Techniques and Technologies

After determining the framework that will be used for access control, it is then appropriate to decide appropriate techniques, along with the technology, to support the chosen framework. The first technique is called rule-based access. It is kind of like an if statement in object oriented programming. If a certain condition is true, then the subject can access objects within the predefined rules. Another technique would be a restricted interface, which limits a user's access to objects as the name implies. Access that is context based looks at situations rather than being only based on identity. Content based access makes decisions based on data. One that is really straightforward is the compatibility table. The subject shows what objects and operations the subject can access. The same is true for an access control list. Another technique that is related to the latter but not completely the same is the matrix. It is a table that shows subject object relationships.

Chapter 3: Access Control - Access Control Models

Access control models are frameworks that allow subjects access objects. I described what a subject and an object is relating to access control in a previous post. A couple of key terms in this section that are worth reiterating are DAC and MAC, where the AC in there abbreviations stand for access control. The first letter of each of there is where their difference comes into play. DAC allows a resource owner to determine which subjects can access specific objects. MAC does not allow owners this discretion. MAC is a lot more strict than DAC in that a MAC system is used for an explicit purpose and nothing more. A third framework after used is role-based (RBAC) in which a central controls are set to determine subject-object interaction.

Chapter 3: Access Control - Authorization

After appropriate authentication has taken place, the next step to access control is authorization. This step is important once the user has gained access to the system, to make sure that that they should be there. Roles, groups, location, and time of day are often used to grant authenticated users authorization. This section of the study guide also goes into more detail about single sign on technologies. They are:

Kerberos - Utilizes tickets and a KDC. Deals with symmetric key cryptography.
SESAME - Utilizes PAS and PACs, both systemic and asymmetric cryptography.
Security domains - Managed by the same group and the same security policies.
Directory services - Access control maintained centrally and resources are standardized.
Thin clients - Relies on a central server for access control, processing, and storage.

Chapter 3: Access Control - Other Identification Methods

There are a few methods is this section of the exam guide that are somewhat self explanatory and I have heard of them before. I want to elaborate on a few that I am not so familiar with or that I have never heard of before by definition. The first is a method known as password hashing. Salts are used in order to add more complexity to add more randomness to the process of encrypting the authentication technique. Hashing makes it a lot harder for a hacker to get to the correct format of the system that implements this technique of identification. Another technique that I have never had the chance use in a real life situation for authentication and identification are the use of cards to gain access to systems. There is one main difference here concerning cards. Memory cards cannot process information whereas smart cards can.

Chapter 3: Access Control - Identity Management Solutions Part 2

This is a follow up to my previous post concerning the six technologies relating to identity management. The first three were described in a previous post, and the next three are examined below.

Legacy single-sign on- Commonly abbreviated to SSO. Idea behind this one is that a user only has to  authenticate once to access information while not having to re-authentencate while in that environment.

Account management- Deals with the delegation of user accounts. Create accounts for all systems, modify privileges, and getting rid of the accounts whenever it comes to point in time in which a specific account is no longer needed.

Profile update- Basically refers to the fact that more than a name is used for an individual profile. A lot of info about the user should be captured. When this collection is associated with a user, it is called a profile. The data for profiles should be centrally located.

Chapter 3: Access Control - Identity Management Solutions Part 1

This post is part one of a two part post. I will identify and briefly describe the technologies that a person who wants take the CISSP exam should be aware of relating to identity management. There are six total. I will describe three here, and the other three will be examined in my following post.

Directories- Usually follow a hierarchical database format that keep track of network resources and users.

Web access management- Controls what users can view and do when utilizing a web-browser to interact with organization or company assets.

Password management - Three technologies that you should be aware of:
1. Password Synchronization - Allows users to use one password for many systems.
2. Self-Service Password Reset - Allows users to reset their own passwords
3. Assisted Password Reset - Includes other forms of authentication for a password reset such as tokens or biometrics.