Chapter Overview
Everything you need to know — at a glance
🧠 Master Mnemonic — Cover ALL topics
"I Always Authorize Basic People's Silly Actions"
One word per major topic in this
chapter
Identification
Authentication (3 factors)
Authorization & ACLs
Biometrics (ERR/FAR/FRR)
Passwords & OTP
SSO & Kerberos
Access Control Models (DAC/MAC/RBAC)
1
Identification
WHO are you claiming to be? (Username)
2
Authentication
PROVE it. (Password, token, fingerprint)
3
Authorization
What are you ALLOWED to do? (Permissions)
🎯 Core Concept
Access Control = managing the flow of information between Subjects (active entities
that request access) and Objects (passive entities that contain information). The goal:
enforce CIA — Confidentiality, Integrity, Availability.
What is Access Control?
A security technique that regulates who or what can view or use resources.
Specifies what users can do, which resources they can access, and what operations they can
perform.
Definition
3 Authentication Factors
Something you know — password/PIN
Something you have — token/smart card
Something you are — biometrics
Key Exam Topic
Something you have — token/smart card
Something you are — biometrics
3 Access Control Models
DAC — Owner decides (Discretionary)
MAC — Labels decide (Mandatory)
RBAC — Role decides (Non-Discretionary)
Must Know
MAC — Labels decide (Mandatory)
RBAC — Role decides (Non-Discretionary)
AAA Protocols
RADIUS (UDP, passwords only), TACACS+ (TCP, full encryption, true AAA), and
Diameter (RADIUS evolved, IETF standard).
Protocols
Identification, Authentication & Authorization
The three distinct and sequential functions of access control
🧠 Remember the order
"I Am Authorized" — IAA in sequence
Identification → "I am Alice" (claim)
Authentication → "Here's my proof" (verify)
Authorization → "Here's what Alice can do" (permit)
👤 Identification
Claim your identity
Username, ID
Username, ID
→
🔐 Authentication
Prove your identity
Password, token, biometric
Password, token, biometric
→
✅ Authorization
Access granted
Based on permissions
Based on permissions
Identification
Definition
Identification = establishing the identity of a subject (user, program, process). Uses public info like
a username.
📋 Good Identification Requirements
- Unique — each value must be unique for user accountability
- Standard Naming — a consistent naming scheme should be followed
- Non-descriptive — should NOT reveal the user's position or role
Authentication — The 3 Factors
🧠 3 Factors Mnemonic
"Know. Own. Are."
Know — Something you KNOW (password, PIN, passphrase)
Own — Something you HAVE (token, smart card)
Are — Something you ARE (biometrics: fingerprint, iris)
Factor 1: Knowledge
Something you KNOW. Passwords, passphrases, PINs. Most
common but weakest — can be guessed, stolen, or shared.
Type 1
Factor 2: Ownership
Something you HAVE. Tokens, smart cards, key fobs. RSA
SecurID is the classic example. Generates OTPs.
Type 2
Factor 3: Characteristics
Something you ARE. Biometrics — digitized physical features
(fingerprint, iris) or behaviors (signature, keystroke).
Type 3
MFA — Multi-Factor Auth
Using 2 or more factors together = strong authentication.
Must combine DIFFERENT types (e.g., password + token = 1+2). Two of the same type = NOT MFA.
Best Practice
Biometrics
Types, error rates, and the Crossover Error Rate (CER)
💡 What is Biometrics?
Verifies identity by analyzing a unique person attribute or behavior — what a person IS. Most expensive
and most accurate form of authentication, but has user acceptance challenges.
🧬 Physiological (Physical)
👤 Face recognition
👆 Fingerprint
✋ Hand geometry
👁 Iris / Retina scan
🧬 DNA
⌨️ Behavioral (Actions)
⌨️ Keystroke dynamics
✍️ Signature dynamics
🎤 Voice recognition
Biometric Error Rates — The Key Exam Concept
🧠 Error Types Mnemonic
"Type 1 = Rejects the Right one. Type 2 = Accepts the Wrong one."
Type II (False Acceptance) is the MORE
DANGEROUS error — you don't want impostors getting in!
Type I Error
🚫✅
False Rejection Rate (FRR)
Rejects an AUTHORIZED user. Annoying but not dangerous. System is too strict.
Type II Error
✅🚫
False Acceptance Rate (FAR)
Accepts an UNAUTHORIZED user. Very dangerous! System is too
lax. The error to AVOID.
CER / ERR
⚖️
Crossover Error Rate
Point where FRR = FAR. Lower CER = More accurate system. Used
to compare biometric systems.
⚠️ Exam Trap: Which error is worse?
Type II (False Acceptance Rate) is always the more critical error to minimize — accepting an impostor is
a security breach. Type I just inconveniences a legitimate user.
Passwords & One-Time Passwords
Most common auth method, its weaknesses, and OTP solutions
📌 Passwords
Most common identification/authentication scheme. Considered a weak security mechanism
on its own — always implement strong password protections and complexity requirements.
Password Attack Techniques
🧠 Password Attacks Mnemonic
"Every Angry Burglar Digs Social holes"
Electronic monitoring (sniffing)
Access the password file
Brute Force Attacks
Dictionary Attacks
Social Engineering
Electronic Monitoring
Sniffing network traffic to capture passwords in transit. Defeated by
encryption (TLS/HTTPS).
Passive Attack
Password File Access
Gaining access to the stored password file (e.g., /etc/shadow on Linux).
Defeated by hashing and salting.
File Attack
Brute Force
Trying every possible combination. Takes time but guarantees success.
Defeated by lockout policies and long passwords.
Exhaustive
Dictionary Attack
Uses a list of common words and passwords. Much faster than brute force.
Defeated by random/complex passwords.
Wordlist
One-Time Passwords (OTP)
✅ OTP Advantage
OTPs (Dynamic Passwords) are NOT vulnerable to electronic eavesdropping, sniffing, or password guessing
— because each password is used exactly once.
| OTP Type | How it works | Example |
|---|---|---|
| Synchronous (Time-Based) | Token generates OTP in sync with the server clock. No challenge needed — just match the current time window. | Google Authenticator, RSA SecurID |
| Asynchronous (Challenge-Based) | Server sends a random challenge value → user enters it into the token → token generates OTP → user sends OTP back to server. | Challenge-Response tokens |
Authorization
Access criteria, key concepts, ACLs, and common pitfalls
Definition
Authorization = determining whether a proven identity has the RIGHT to access requested resources. Based
on level of trust + need to know.
Access Criteria — How Access is Granted
🧠 Access Criteria Mnemonic
"Really Good Locations Tend To Work"
Roles — job function (manager, cashier)
Groups — multiple users needing same access
Location — where access comes from (local vs remote)
Time — restrict access to certain hours
Transaction Types — what functions can be performed on data
W—(see table below)
| Criteria | Description | Example |
|---|---|---|
| Roles | Access based on job function | Managers vs. Clerks vs. Cashiers |
| Groups | Multiple users needing the same access | HR Group, IT Group |
| Location | Restrict remote access to sensitive systems | No remote admin to servers |
| Time | Restrict access to certain hours | Database only accessible 8am–6pm |
| Transaction Types | Control what functions can be run on data | Read-only during audit period |
Critical Authorization Concepts
Authorization Creep
When employees accumulate permissions over time without old ones being
removed. A major security risk — regularly review and revoke unneeded access.
Risk
Default to Zero
Start with ZERO access and only grant what is needed. Opposite of "allow by
default." This is the secure baseline principle.
Principle
Need to Know
Users get access ONLY to information they absolutely require for their job
duties. Even if they have a clearance, they must have a need to know.
Principle
Access Control Lists (ACL)
A list of subjects (users) that are authorized to access a particular object
(resource). Bound to the OBJECT. Tells the object who can access it.
Tool
Single Sign-On (SSO)
One login for everything — benefits, risks, and technologies
What is SSO?
Single Sign-On allows user credentials to be entered ONE time, granting access to ALL authorized
resources across primary and secondary network domains. Also called "reduced sign-on." Used in federated
identity management systems.
🧠 SSO Technologies Mnemonic
"Kerberos Sits Securely, Drawing Diagrams"
Kerberos
Sesame
Security Domains
Directory Services
Dumb Terminals
⚠️ SSO Cons
Single Point of Compromise — one stolen credential = access
to everything
Legacy Interoperability — older systems may not work with SSO
software
Implementation Difficulties — unusual systems may not
interface well
✅ SSO Pros
Efficient logon — user logs in only once for all authorized
systems
Stronger passwords — one password to remember → users choose
harder ones
Centralized administration — consistent policy application
across the org
⚠️ Key SSO Risk — Single Point of Failure
The biggest downside: one compromised login = attacker accesses ALL of the user's authorized resources.
This is the critical exam trade-off for SSO.
Access Control Models
DAC, MAC, and RBAC — know them cold
🧠 3 Models Mnemonic
"Decide by: Discretion, Mandatory labels, or Roles"
DAC — Owner decides (Discretionary)
MAC — System labels decide (Mandatory)
RBAC — Job role decides (Non-Discretionary)
| Model | Full Name | Who Controls Access? | Best Used When | Key Trait |
|---|---|---|---|---|
| DAC | Discretionary AC | The OWNER of the resource decides who can access it | Flexibility needed; small environments | Most flexible, least secure |
| MAC | Mandatory AC | The SYSTEM enforces based on security labels & clearances | Military/government where confidentiality is critical | Most rigid, most secure |
| RBAC | Role-Based AC | Centrally-administered ROLES determine access | Organizations with high staff turnover | Best for orgs — easy to manage |
DAC — Discretionary
The OWNER of the resource decides who gets access. Like owning a file and
deciding who can read it. Used in most OS file systems (Windows, Linux). Most flexible but can
lead to inconsistent security.
Owner Controls
MAC — Mandatory
Uses a SECURITY LABELING SYSTEM. Users have clearances; resources have
classification labels (Top Secret, Secret, etc.). System enforces — users cannot override. Used
in the military.
System Controls
RBAC — Role-Based
Access determined by JOB ROLE, not individual identity. Centrally
administered. Best for high-turnover organizations — change the role, permissions follow
automatically.
Role Controls
Access Control Techniques
Rule-based, constrained interfaces, and access control matrix
🧠 3 Techniques Mnemonic
"Rules Constrain Matrices"
Rule-Based Access Control
Constrained User Interfaces
Matrix (Access Control Matrix)
Rule-Based AC
Uses specific rules defining what CAN and CANNOT happen between subject and
object. Not necessarily identity-based. Classic example: FIREWALLS.
Traditionally used in MAC systems.
Firewall = Rule-Based
Constrained User Interfaces
Restricts user access by hiding or disabling options they're not allowed to
use. Three types: Menus & Shells, Database Views, Physically Constrained
Interfaces (e.g., ATM keypad).
UI Restriction
Access Control Matrix
A table mapping subjects × objects showing what actions each subject can take
on each object. Two views: Capability Table (bound to subject) and
ACL (bound to object).
Subject × Object Table
Access Control Matrix — The Two Views
| View Type | Bound To | How to Think About It |
|---|---|---|
| Capability Table | SUBJECT (User) | Read down a ROW — shows everything THIS USER can access. "Here are Alice's capabilities." |
| Access Control List (ACL) | OBJECT (Resource) | Read down a COLUMN — shows everyone who can access THIS RESOURCE. "Here's who can access File1." |
Centralized vs Decentralized Administration
✅ Centralized
One entity oversees all corporate resource access
Consistent & uniform method of controlling access rights
Protocols used: RADIUS, TACACS+, Diameter
⚠️ Decentralized
Control given to people closer to the resources
No consistent control — lacks proper consistency
Harder to enforce organization-wide policy
RADIUS, TACACS & Diameter
AAA protocols — know the differences cold
🧠 RADIUS vs TACACS+ Key Differences Mnemonic
RADIUS = "Rapid but Partial" · TACACS+ = "Total Armored Control"
RADIUS → UDP, encrypts password only, combines auth+authz
TACACS+ → TCP, encrypts everything, separates
auth+authz+accounting
| Feature | RADIUS | TACACS+ | Diameter |
|---|---|---|---|
| Full Name | Remote Authentication Dial-In User Service | Terminal Access Controller Access Control System | Diameter (IETF RFC 3588) |
| Transport Protocol | UDP (ports 1812, 1813) | TCP (port 49) | TCP/SCTP |
| Encryption | Only encrypts the password field | Encrypts the entire packet (except TACACS header) | Full encryption |
| AAA | Combines Authentication + Authorization (together) | Separates Auth, Authz, and Accounting (true AAA) | True AAA, extensible |
| Best For | Simple username/password auth; ISP dial-up | Environments needing full security & granular control | Modern apps needing extensible AAA |
| Who Uses It | Most ISPs — authenticates customers before internet access | Enterprise networks — Cisco AAA architecture | Mobile networks, modern AAA apps |
💡 RADIUS Expanded: R-A-D-I-U-S
Remote Authentication Dial-In
User Service — open protocol, client/server architecture, UDP-based,
only encrypts password. Appropriate for simple accept/deny decisions.
💡 TACACS+ Advantage
TACACS+ separates authentication from authorization so they can be implemented on DIFFERENT security
servers. Provides true AAA architecture and encrypts all data — superior to RADIUS for enterprise
security.
💡 Diameter = RADIUS 2.0
Diameter was built to overcome RADIUS limitations. It's an IETF standard (RFC 3588). Applications
requiring AAA can define extensions on top of the Diameter base protocol.
Accountability & Best Practices
Audit trails, monitoring, and access control hygiene
What is Accountability?
Accountability is tracked by recording user, system, and application activities. Audit information MUST
be regularly reviewed. It answers: WHO did WHAT, WHEN?
🧠 Audit Review Types Mnemonic
"Even Real Auditors Validate Attacks"
Event-Oriented Audit Review
Real-Time & Near Real-Time Review
Audit Reduction Tools
Variance Detection Tools
Attack Signature Tools
Keystroke Monitoring
Records every keystroke made by a user during an active session. Very
effective for detecting malicious insiders. Has privacy implications — must be
disclosed in policy.
Monitoring
Scrubbing
Removing specific incriminating or unpleasant data from within audit logs. A
malicious act performed by someone trying to cover their tracks.
Threat to Logs
Access Control Best Practices Checklist
🧠 Best Practices Mnemonic
"Don't Ever Suspend Rogue People — Audit Protects"
Deny anonymous account access
Enforce strict access criteria
Suspend inactive accounts
Replace default passwords
Password rotation — enforce it
Audit and review regularly
Protect audit logs from modification
Flashcards
Click each card to reveal the answer — test yourself!
Loading...
Click to flip and reveal answer ↻
Loading...
1 / 20
Knowledge Quiz
10 questions covering the full chapter — no peeking!
Your Final Score
0/10