Access Control Chapter 3 Part 4 Pages 227 to 241

Rule-Based Access Control See page 228 Traditionally, used with MAC See page 228 Many routers and firewall use rules to determine which packets are allowed in

Constrained User Interfaces Restricted menus Database views – Page 229 Figure 3-17 ATM machines

Access Control Matrix Figure 3-18 on page 230 Capability Tables – Table 3-1 on page 230 – Figure 3-18 on page 230 – Kerberos – user’s ticket is his capability table Access Control List (ACLs) – Table 3-2 on page 231 – Figure 3-18 on page 230

Content-Dependent Access Control Example filter – Specific string such as “social security number”, “top secret” Example web filter for employees – “gambling”, “pornography”

Context-Dependent Access Control Stateful Firewalls – Make sure there is a TCP connection Tracks user’s request in sequence looking for suspicious patterns

Access Control Techniques Page 233

Centralized Access Control Administration One entity oversees access to all corporate resources Consistent and uniform method of controlling user access AAA protocols – Authentication – Authorization – Auditing

RADIUS Network protocol that provides client/server authentication, authorization, and auditing of remote users. Most ISP use RADIUS – Customer provides username and password – Customer is given an IP address and Internet access Used for Road warriors and home workers.

TACACS+ Similar to RADIUS RADIUS uses UDP TACACS+ uses TCP – Detects packet corruption, dropped packets Encrypts all data If current environment authenticates users using Kerberos, TACACS+ can authenticate remote user’s in the same manner.

RADIUS vs TACACS+ RADIUS is the appropriate protocol when simplistic username/password authentication when need only Accept or Deny TACACS+ for more sophisticated authentication and complex authorization See Table 3-3 on page 238

Diameter Protocol built on functionality of RADIUS but for today’s diverse networks See Figure 3-21 on page 239

Decentralized Administration Give access control to those closer to the resources Manager for his employees Does not provide uniformity