Authentication and Access Control

Overview of access control

❖ ❖

Authentication and Authorization

❖

Identification and authentication techniques

❖

Access control techniques

❖

Access control methodologies,

implementations and administration

Access control is a security technique that

❖

regulates who or what can view or use resources in a computing environment.

❖

It permits management to specify

• what users can do,
• which resources they can access, and
• what operations they can perform on a system.

Identification, Authentication, and Authorization are distinct functions.

❖ Identification

• Method of establishing the identity of subject’s (user, program, process).

❖ Authentication

• Method of proving the identity.

❖ Authorization

• Determines whether the proven identity has the right to access the requested resources not.

Identification

❖ Method of establishing the identity of subject’s

(user, program, process).

• Use of user name or other public information.
• Know identification component requirements.
  • Each value should be unique, for user accountability;
  • A standard naming scheme should be followed;
  • The value should be non- descriptive of the user’s position or tasks.

Passwords

❖ most common identification, authentication

scheme.

❖ Weak security mechanism, must implement strong

password protections (password complexity

)

Techniques to attack passwords

❖

Electronic monitoring

❖

Access the password file

❖

Brute Force Attacks

❖

Dictionary Attacks

❖

Social Engineering

One Time Passwords (aka Dynamic Passwords)

❖

Used for authentication purposes.

❖

This type of system is not vulnerable to electronic eavesdropping, sniffing, or password guessing.

Two types of Token Devices (aka Password Generator)

❖ Synchronous

• Time Based
  • Token generate the OTP in synch with server

❖

Asynchronous

• Challenge based authentication
  • Server sends a challenge value.
  • user should enter the challenge value to token to generate OTP, then send to server.

Access Criteria can be thought of as:

❖

Roles

• Is an efficient way to assign rights to a type of user who performs a certain task. (job assignment or function: managers, clerks, cashiers, supervisors, etc.)

❖

Groups

• When several users require same type of access to information and resources

❖

Location

• To restrict unauthorized individuals from being able to get in and reconfigure the server remotely.

❖ Time

• Restrict the times that certain actions or services can be accessed. Transaction Types

❖

• Can be used to control what data is accessed during certain types of functions and what commands can be carried out on the data.

Pros :

❖

Efficient log-on process -The user logs on only once to access all authorized systems.

❖

Encourages users to create stronger passwords -With only one password to remember and control, users may be inclined to use passwords that are harder and more difficult to crack. Fewer passwords to manage should also result in fewer being written down in unsafe locations.

❖

Centralized administration -Ensures consistent application of policy and procedures.

Cons :

❖ Single point of compromise -A single compromised sign-in allows the intruder

into all of the account owner‟s

authorized resources.

❖ Legacy Interoperability -It may be difficult to include unique computers or

legacy systems in the single sign on network.

❖ Implementation difficulties -Unusual types of systems may not interface well

with SSO software.

Three Main Types

❖ Discretionary (Unrestricted) ❖ Mandatory ❖ Non-Discretionary (Role Based)

Discretionary Access Control (DAC)

❖

A system that uses discretionary access control allows

the owner of the resource to specify which subjects can access which resources.

❖

Access control is at the discretion of the owner.

Mandatory Access Control (MAC)

❖

Access control is based on a security labeling system. Users have

security clearances and resources have security labels that contain data classifications.

❖

This model is used in environments where information

classification and confidentiality is very important (e.g., the military).

Non-Discretionary (Role Based) Access Control Models

❖

Role Based Access Control (RBAC) uses a centrally administered

set of controls to determine how subjects and objects interact.

❖

Is the best system for an organization that has high turnover.

There are several different access controls and technologies available to support the different models.

❖ Rule Based Access Control ❖ Constrained User Interfaces ❖ Access Control Matrix

Decentralized Access Control Administration:

❖ Gives control of access to the people who are closer to the

resources

❖ Has no methods for consistent control, lacks proper

consistency.

Accountability is tracked by recording user, system, and application activities.

Audit information must be reviewed

❖ Event Oriented Audit Review ❖

Real Time and Near Real Time Review

❖

Audit Reduction Tools

❖

Variance Detection Tools

❖

Attack Signature Tools

Know the access control tasks that need to be accomplished regularly to ensure satisfactory security.

Best practices include:

❖ Deny access to anonymous accounts ❖ Enforce strict access criteria ❖ Suspend inactive accounts ❖ Replace default passwords ❖ Enforce password rotation ❖ Audit and review ❖ Protect audit logs