Access Control

Assignment Review  Current –You decide what categories you want to include. Just provide the required justification.  Next  Detailed rubrics are in the Instructor Files section. 7/9/2016 Access Control 2

7/9/2016 Access Control 3 Traditional AAA  Authentication  Access Control  Auditing

7/9/2016 Access Control 4  Discretionary Access Control  Mandatory Access Control  Role Based Access Control  ACL

7/9/2016 Access Control 5 Discretionary Access Control  Owner Decides  Default mode for may mobile, home devices

7/9/2016 Access Control 6 Mandatory Access Control (MAC)  Hierarchical  Top Secret  Secret  Confidential

Bell LaPadula is model for MAC  Objects have sensitivity label  Users have clearance level  Access granted if clearance=>label  Can write up but not down and can read down but not up (* property)  Does not consider compartmentalization or need to know 7/9/2016 Intro Computer Security 7

Biba Integrity Model  Can read at their highest integrity level  Can write at or lower then their integrity level 7/9/2016 Intro Computer Security 8

Clark-Wilson  Focus on “well ordered transactions” to raise integrity levels  Separation of Duties also key to preserve integrity 7/9/2016 Intro Computer Security 9

7/9/2016 Access Control 10 Role Based Access Control  What you can do depends on what job you have  Popular in active directory environments  Typically pushes assignment of rights to resource to owner of resource

7/9/2016 Access Control 11 ACL  Specific list  Often matrix of User, resource, rights generated by the system  Often seen in routers, firewalls, personnel access

7/9/2016 Access Control 12 Auditing  Two senses  Log watch  Auditing for Compliance

Logs  Critical to monitor  Organization will generate tons of logs  Must use tools to monitor for exceptions 7/9/2016 Access Control 13

Auditing for Compliance  Should verify you comply with appropriate laws  Especially prior to review/audit 7/9/2016 Access Control 14

Some Fundamentals 7/9/2016 Intro Computer Security 15

Three types of Security Controls  Classical –Physical –Administrative –Technical  Popular –Preventative–Preventative –Detective–Detective –Responsive–Responsive 7/9/2016 Intro Computer Security 16

Other Controls  In the course we will refer to controls not by category but more specifically: –AV –IDS –Policy 7/9/2016 Intro Computer Security 17

Information Security Principles of Success  Defense in Depth Critical  People Make Bad Security Decisions  Security Depends on –Functional Requirements –Assurance Requirements  Security Through Obscurity  Security is Risk Management 7/9/2016 Intro Computer Security 18

7/9/2016 Intro Computer Security 19 And More Principles  Complexity is the Enemy of Security  FUD Doesn't Work –Long term anyway  People, Process & Technology are all needed  Open Disclosure is Good for Security

7/9/2016 Intro Computer Security 20 Principles  No Absolute Security  Non-repudiation –You cannot deny having done a particular action –No shared IDs or passwords

More Security Principles  Separation of Duties  Principle of Least Privilege  Need to know  Defense in Depth  Complexity is the enemy of security  Industry best practices is only the lowest common denominator 7/9/2016 Access Control 21

7/9/2016 Intro Computer Security 22 Why Study InfoSEC?  Increasing Threat Spectrum  Compliance  Business Enabler

7/9/2016 Intro Computer Security 23 The InfoSEC Professional  Old Guys  The New folks

7/9/2016 Intro Computer Security 24 Other InfoSEC terms  IA  Computer Security  Information Security

Professional Development

7/9/2016 Intro Computer Security 26 Certifying Organizations  Establishment of certifying organizations key step to security as a profession

7/9/2016 Intro Computer Security 27 Some Organizations  ISC2  ISACA  CompTIA  ASIS  Other key security organizations –NIST - U.S., but a leading organization –ISO - world wide

7/9/2016 Intro Computer Security 28 Certification Programs  ISC2 Common Body of Knowledge  Not universal, ISC2 adds several specialized domains –The most Widely Accepted  DHS has another view as does SANS and CompTIA

7/9/2016 Intro Computer Security 29 ISC2 CBK often used in Educational Environments  10 Domains are good intro coverage

Question for you  What did you find most interesting in the reading so far?  Any war stories where one of these went wrong? Weren’t in place? 7/9/2016 Intro Computer Security 30

7/9/2016 Access Control 31 Questions ?