FUNDAMENTAL CONCEPTS IN COMPUTER SECURITY Dr. Shamik Sural Dept. of computer science & engineering Iit kharagpur

Agenda Basic Terminology Access Control Models Role-based Access Control New Access Control Techniques

Basic Terminology Confidentiality, Integrity, Availability Which one is more important Authentication and Authorization How are they different Assurance How to decide which software to use Threats and Attacks Different types of malicious intent

Evolution of Access Control Models DAC (1970) MAC RBAC (1995) ABAC (2010+)

Traditional Access Control Types Discretionary Access Control Model (DAC) Access to a resource determined by the owner of the resource Mandatory Access Control Model (MAC) Establishes access control by defining clearance levels of resources as well the requestors Requestor cannot read a resource whose clearance level is greater than that of the requestor Role Based Access Control (RBAC) Many requestors grouped to form roles Roles are assigned permissions Access control based on the role of requestor

RBAC Model

RBAC Model – User to Role Assignment Librarian Deputy Librarian Assistant Librarian (Acq.) Assistant Librarian (Circ.) Library Employee Member ABC 1 DEF GHI JKL MNO PQR STU VWX YZ

RBAC Model – Role to Permission Assignment App. Purch. Order New Book Waive Fine Issue Book Return Calc. Fine Declare Lost Request New Journal Sub. Approve New Recruit. Hire Interns View Catalog Librarian 1 Deputy Librarian AL (Acq.) AL (Circ.) Lib. Employee Member

RBAC Model –Role Hierarchy Librarian Deputy Librarian Assistant Librarian (Acquisition) Assistant Librarian (Circulation) Library Employee Member

RBAC Model – Effective Permission Assignment User App. Purch. Order New Book Waive Fine Issue Book Return Calc. Fine Declare Lost Request New Journal Sub. Approve New Recruit. Hire Interns View Catalog ABC 1 DEF GHI JKL MNO PQR STU VWX YZ

RBAC Model for Library Software Development Project Supervisor Role Software Engineer Role Hardware Engineer Role Project Member Role

Interesting Role Hierarchies Software Engineer’S Project Supervisor Role Hardware Engineer’S Private Role Private Role Software Engineer Role Hardware Engineer Role Project Member Role

Introduction to ABAC A more general form of access control. Covers DAC, MAC and RBAC Policies formulated based on general attributes of subjects rather than their identity or role or clearance level, etc. Environment conditions taken into considerations Flexible in terms of policy formulation and attribute update More on this next time 

THANK YOU