In this article
CISSP Prep: Understanding Access Control
- Access Control Categories
- Identification and Authentication
- Identity as a Service
- Mitigating Access Control Attacks
- Understanding Access Control
In this article
In any technological infrastructure, laying out the rules, regulations and protocols for access control is of paramount importance. As the name indicates, access control allows a system architect to ensure the prevention of unauthorized access of important resources, privileges and data. In today’s world, the vulnerabilities that can be present in a system are increasing exponentially as modern hackers continue to find new security loopholes. During the development of an architecture, framework or enterprise software solution, after we have identified the assets, we need to search for the possible vulnerabilities and threats that could be targeted by people with sinister intentions.
In this article, the rudimentary tenets of security access control are explained along with possible ways to ensure rigorous security in a system.
Before we can find risks, mitigate them and make our system secure, we need to identify the most important assets of our system. An access control’s definition would not make any sense if we didn’t know the assets that we want to limit access to.
In the domain of information security, asset can be defined as any device, data or component that supports data-related activities in a system. Assets include software (support systems, critical applications), hardware (routers, switches, servers, RAIDs) and confidential information (user pertinent data). The protection of assets from theft, destruction, disclosure and unauthorized access is mandatory.
The process of asset classification begins with their identification. Once identified, we perform the accountability process, followed by schema creation and eventually the classification schema implementation. Identifying assets is a fairly simple task; you just have to figure out the components of your infrastructure that are “critical” for your system’s availability.
Once we are able to figure out the critical assets that are essential for the safe running of the business, we are able to make sound decisions to ensure high security levels (that are mandatory to ensure maximum protection). Additionally, it also allows system engineers to determine the redundancy levels that would be required in order to ensure complete backup capability in case of catastrophe. Broadly, we can categorize assets into the following types:
All the information pertinent to your business and system will fall under this type. The information can be organized or classified (and even collected) in different forms. Let’s see some examples:
As the name indicates, physical assets consist of the tangible and visible equipment of a system. They can include:
Software assets are arguably the most important, and ensuring their security should always be a top priority. They can be further divided into two categories:
Last but certainly not of least importance, the services offered by a system are also important assets. They can include:
Once we have been able to identify the assets of our system, we need to find out their corresponding “Values.” An asset can best be valued by the owner of the asset. Only when we are able to value an asset are we able to find the extent to which we must go to ensure its security. This encompasses the replacement value (along with the penned down value). Once we have truly valued an asset, we will be able to go about identifying the measures that are needed to ensure its adequate protection.
Now that we know the most important assets of our system, we can try to determine the possible risks that can be present. The risk identification process can be long (and should be long), and if done the right way, it can go a long way to ensuring the development of a sound infrastructure. A brief overview of the risk identification process can be:
The most common risks in the domain of cyber security are:
Identifying and understanding the possible vulnerabilities in a system is of critical importance. Vulnerabilities transcend risks in importance and danger because they often remain undetected. Once identified, vulnerability analysis procedures need to be carried out to ensure maximum protection of a system from the bad guys (hackers, etc.). The key actions that need to be taken are:
More information regarding detecting vulnerabilities in a system can be found here.
It’s possible for the system to possess certain sources of threat, even after adequate risk mitigation and vulnerability assessment procedures. Threat modeling is hence a substantially important step in the system development process. The three different techniques that can be used to model threats are:
There are many ways to mitigate threats to a system. These include:
Access Control Lists
An ACL or an access control list is a list that contains Access control entries (ACE). An ACE represents a trustee and also signifies the access rights that are allowed, audited or denied for the specific trustee. There are two different types of access control lists, namely the DACL or the SACL.
The discretionary access control list (DACL) maintains the collection of trustees that have been denied or allowed access to a specific object. A system access control list (SACL), on the other hand, maintains the number of access attempts that have been made for an object.
Both DACLs and SACLs should be maintained for a system and should be periodically monitored and updated.
MFA or multi-factor authentication is another method to ensure the sanctity and security of a system. With MFA, a user only gets granted access to a resource once they have presented different pieces of evidence to the authenticating entity. Normally, the requestor of access has to present possession (something they own), inherence (who they are) and knowledge (something they are aware of) to the system.
Data encryption via the most unbreakable cryptographic algorithms can also help a security architect in ensuring the integrity and security of the system. The RSA algorithm can be considered a recommended choice for this purpose. The Kerberos V5 protocol is an ideal choice for systems that require communication between authenticated servers and clients.
Sophisticated password policies should also always be in place to ensure security and stringent access control. Even though a strong password policy is a nuisance for the users, it has become an absolute necessity today.
The objective of this article is to make readers aware that secure access control has become a necessity for architectures or organizations or systems. If the processes of asset identification, risk mitigation, vulnerability analysis and threat prevention are paid extra heed to during the development (and maintenance) of a system, then access to valuable resources can be excellently controlled.