Chapters 13 & 14

Access Management

Assets

• information
• systems
• devices
• facilities
• personnel

Access control

Subjects vs Objects

Access control types

• Preventive
  • Deterrent
  • Directive
• Detective
• Corrective
  • Recovery
• Compensation

Access control implementations

• Administrative
• Logical/Technical
• Physical

IT Loss Types

• Confidentiality
• Integrity
• Availability

Identity

• Unique

Authentication

• Verifies identity

Authorization

• Grants access to a proven identity

Accountability

• Logging
• Audit trail

Authentication factor types

1. Something you know
2. Something you have
3. Something you are/do
4. Somewhere you are

Type 2

• Hardware tokens
  • Synchronous
  • Asynchronous

Biometrics

• As identifying/authenticating/both
• Physiological/behavioural
• Error Ratings
• Enrollment/registration
  • Reference profile
• Throughput rate
• Acceptance

Multifactor Authentication

• Using two or more factors
• Must use different factors for benefit

Device Authentication

• Device fingerprinting
  • IdP - SecureAuth Identity Provider for device authentication

Identity Management

• Centralized
• Decentralized/distributed

Single Sign On (SSO)

• Centralized
• Increases security

Lightweight Directory Access Protocol: LDAP

• An SSO mechanism
• Uses Domains and Trusts

Ticket authentication

• Kerberos
  • Key Distribution Center
  • Kerberos Authentication Server
  • Ticket granting ticket
  • Ticket/Service ticket
• SESAME, KryptoKnight, NetSP
• OAuth, OpenID

Federated Identity Management

• SAML
• XACML

Credential Storage Systems

• KeePass
• Windows Credential Manager

Session management

• Screen savers
• Online session timeouts

AAA Protocols

• RADIUS
• TACACS+
• Diameter

Identity and Access Provisioning Life Cycle

• Provisioning
• Review
• Revocation

Access control issues

• Excessive privilege
• Creeping privileges

Authorization Mechanisms

• Implicit Deny
• Access Control Matrix
• Compatibility Tables
• Constrained Interface
• Context-Dependent Control
• Least Privilege
• Separation of Duties/Responsibilities

Discretionary Access Controls

• Defined by data custodian

Non-discretionary Access Controls

• Role-based Access Control
• Rule-based Access Control
• Mandatory Access Controls

Risk Elements

• Identify assets
  • Asset Valuation
• Identify threats
  • Threat modeling
• Identify vulnerabilities
  • Vulnerability Analysis

Access Control Attacks

• Password Attacks
• Spoofing Attacks
• Social Engineering Attacks
• Smartcard Attacks
  • Side-channel attack
• Denial-of-Service Attacks (DoS)