Access Control

Access controls come in three types, and each one is a different kind of barrier. Know one example of each and what makes it that type.

Mantrap

Entry system that staggers the flow of people into a secured area and traps unwanted visitors (a two-door vestibule holding one person at a time).

Clipping level

An allowed threshold for errors before a red flag is raised.

ACL

Defines the type of traffic allowed on a network; a logical control.

AAA (authentication, authorization, accounting) is the primary framework for controlling access. It prevents unauthorized access to a computer, network, database or other data resource.

Authentication

Verifies each user's identity. The user gives a username or ID, then proves it.

Authorization

Determines which resources the user can access and which operations they can perform. Applied automatically straight after authentication.

Accounting

Tracks what users do: what they access, how long, and any changes they make. Not financial accounting.

The credit card analogy fits all three. Authentication is who can use the card, authorization is how much they can spend, and accounting is what they spent it on.

Being able to log on to the corporate network does not mean you may use the high-speed colour printer. That gap is authorization. Authorization can also control when: employees may reach a sales database during work hours and be locked out after hours.

Identification is claiming an identity with a unique identifier, most often a username. It could also be an alphanumeric combination, a PIN, a smart card, or a biometric such as a fingerprint, retina scan or voice recognition. Authentication proves the claim. Policy and the sensitivity of the system decide how strict identification must be.

• —Strong password: at least eight characters, mixing upper and lower case, numbers and special characters. Not so long it cannot be memorized, not so short it is easy to crack.
• —Not personal: a name, birthdate or address is easier for criminals to guess.
• —Unique per system: one cracked password must not open every account. A password manager creates and stores strong passwords.
• —Smart card: credit-card-sized plastic card with an embedded chip that processes, stores and safeguards data such as bank account numbers, ID, medical records and digital signatures.
• —Security key fob: small enough for a keyring and mostly used for two-factor authentication. You enter username and password, then type the number the fob displays.
• —Biometrics compare physical traits to a stored profile (a data file of known characteristics). Access is granted on a match. It needs a reader, software that digitizes the scan, and a comparison database.

Physiological biometric

Fingerprints, DNA, face, hands, retina, ear features.

Behavioral biometric

Gestures, voice, gait, typing rhythm.

Multi-factor authentication (MFA)

At least two verification methods. Knowing a password alone then gains an attacker nothing.

Two-factor authentication (2FA)

MFA with exactly two factors. The two terms are often used interchangeably.

Authorization controls what a user can and cannot do after authenticating. It uses attributes that answer: what read, copy, edit, create and delete privileges does this user have? The system compares them with the authentication database and delivers the restrictions to the device the user is on. Defining the rules in an authorization policy is the first step.

Group membership policy

Authorization by group. Example: all staff have a swipe card for the premises, but only senior staff and IT can open the server room.

Authority-level policy

Permissions based on an employee's position in the organization.

Accountability

Traces an action back to the person or process that made it, then reports the usage data for auditing or billing.

• —Data collected: login time, whether login succeeded or failed, and which network resources were accessed.
• —Log files: login failures can signal a criminal trying to hack an account; successes show who uses which resources and when.
• —Policies and procedures say what actions are recorded and how logs are generated, reviewed and stored.
• —Also provides accountability: data retention, media disposal, compliance requirements, and education and awareness.

Federated identity management lets several enterprises accept the same credentials across all their networks, so the user gets single sign-on to the web (one social login on several websites). It broadens the scope and raises the chance of a cascading effect if an attack happens, so partners must scrutinize what identity information they share. The most common protection is to tie login ability to an authorized device.

Zero trust is a comprehensive approach to securing all access across networks, applications and environments. The principle is "never trust, always verify": assume zero trust whenever someone or something requests access. It prevents unauthorized access, contains breaches and reduces an attacker's lateral movement.

Traditionally the perimeter was the edge between trusted inside and untrusted outside. In zero trust, any place an access decision is made counts as a perimeter. Passing one check earns no trust elsewhere; users may have to authenticate several times, in different ways, for different layers.

Principle of least privilege

Users and processes get the minimum access needed to do their work function. A limited, as-needed approach; goes with need-to-know access.

Privilege escalation

Exploiting vulnerabilities in servers or access control systems to give an unauthorized user or process higher privilege than it should have, then reading sensitive data or taking over the system.

NAC (network access control)

Enforces organizational policy on the people and devices trying to access the network. A component of zero-trust architecture.

• —NAC enforces access policies quickly for different operational conditions.
• —It recognizes and profiles connected users and devices.
• —It gives guests secure access, often through registration portals.
• —It checks compliance by user type, device type and operating system before permitting access.
• —It blocks, isolates or repairs non-compliant devices.
• —It matters because BYOD and IoT greatly expand the attack surface; without NAC staff could not evaluate thousands of devices.

An access control model is the method that decides who may use what. The exam asks you to name the model from a short scenario, so tie each one to who or what makes the decision.

• —RBAC suits large organizations with hundreds of users and thousands of possible permissions, and is widely accepted as best practice. It can enforce the policies of DAC or MAC.
• —Rule-based can be combined with other strategies; MAC can use a rule-based approach.
• —Both MAC and rule-based: users cannot change the access rules.

Administrators give every user an account type that fits their role so people can reach data only on a need-to-know basis. This limits security and compliance risk.

User account

Day-to-day use of system resources.

Service account

Interaction with the operating system.

Guest account

Temporary users who need installed applications.

Administrator account

Used only to administer a system. Browsing or opening email as admin puts the organization at risk if malware gets in.

• —Do not share accounts for privileged users, administrators or applications.
• —Replace default accounts (guest, administrator) because attackers know their default settings, and make every account type require a password.
• —Privileged accounts are the main target: the most powerful accounts with unrestricted access. Reduce their number, apply least privilege, and revoke rights when staff leave or change jobs.
• —Change privileged passwords automatically every 30 or 60 days, remove shared credentials, record privileged sessions, log all activity and alert on unusual behavior.
• —Disable inactive privileged accounts and use MFA for all administrative access.
• —Put a gateway between the end user and sensitive assets to limit malware exposure.

• —A deny overrides every other permission, even for administrators.
• —New files and folders inherit the parent folder's permissions. Permission propagation applies the same permissions to all subfolders at once.
• —Moved within the same volume: keeps original permissions. Copied (same or different volume) or moved to a different volume: inherits the new location's permissions.
• —To let a team view project documents but not edit, create or delete them, grant read and execute.

In a Windows domain, the administrator sets a domain security policy on the server and it applies to all domain members. A computer outside an Active Directory domain uses Local Security Policy, opened with secpol.msc in the Run box (not available in Home edition).

• —Password policy (example): change every 90 days, use each new password at least one day, at least eight characters with three of four categories (upper, lower, numbers, symbols), reuse only after 24 unique passwords.
• —Account lockout policy (example): five wrong attempts locks the account for 30 minutes, then the attempt count resets.
• —Audit policy creates a security log tracking account logon events, account management, directory service access, object access, policy changes, privilege use, process tracking and system events.

SSO

One set of login credentials across multiple applications.

OAuth

Standard that lets third-party services such as Facebook or Google use a user's account information.

Password vault

Stores credentials behind one strong password.

KBA (knowledge-based authentication)

Personal questions used to reset a forgotten password.

HMAC

A hash function combined with a secret key to authenticate a web user. Basic authentication does not encrypt username and password; with HMAC the user sends a key identifier and an HMAC, and the server looks up the key, recomputes the HMAC and compares. IPsec VPNs use HMAC to authenticate each packet's origin and check integrity.

• —Use SHA-256 or higher for hashing. Avoid SHA-1 and MD5 because of discovered flaws.
• —Hashes are used with a secret key (IPsec, routing protocol authentication), for one-time challenge responses, and for message integrity in signed contracts and PKI certificates.
• —Hashing detects accidental changes but not deliberate ones, so it is open to man-in-the-middle attacks.

An authentication protocol authenticates data between two entities and defines what information must be shared to authenticate and connect.

Kerberos works in two steps. The authentication service issues a ticket-granting ticket (TGT) to the requesting client. The client presents the TGT and asks for a ticket to a specific server; that service ticket gives access to the service. Tickets are timestamped and expire, so reusing one fails, and the session can be encrypted so passwords are not sent where they could be intercepted.

A network must control who may connect and what they may do once connected. The network security policy sets these requirements and can require an accounting system to track who logged in, when and what they did. AAA gives the scalable framework to enforce it. AAA authentication covers administrative access and remote network access.

A centralized AAA system can keep separate databases for authentication, authorization and accounting. It can use Active Directory or LDAP for user authentication and group membership. Devices talk to the AAA server using RADIUS or TACACS+.

AAA accounting collects and reports usage data in logs for security auditing. Centralized AAA sends records from every device to central repositories, which simplifies auditing. The data can include start and stop connection times, executed commands, and packet and byte counts.

• —A start message is generated once the user has authenticated; a stop message is recorded when the user finishes.
• —Combined with authentication, accounting keeps a detailed log of what an administrator does on a device, including every EXEC and configuration command, with username, date, time and the command typed.
• —That log helps with troubleshooting and gives evidence against people who act maliciously.