Access controls are a collection of mechanisms that work together to create a security architecture to protect the assets of the information system. The purpose of Access Control Systems are Confidentiality; information is not disclosed to unauthorized individuals or processes, which protects against hackers, unprotected communications, unauthorized users. Integrity; information retains its original level of accuracy, which protects against unauthorized data modifications, system changes, or program changes. And Availability: reliable accesses to data, which protects against denial of service, ping attacks and e-mail flaming.
There are numerous techniques and technologies that can be used to implement a secure access control system. Access Control serves, primarily, two purposes:
1. Provides security features that control how users and systems communicate and interact with other systems and resources.
2. Protects resources from unauthorized access and usually determines the level of authorization granted after and authentication procedure has successfully completed.
Identification is the method of ensuring that a subject is who they claim to be. Some examples of identification are, username, PIN, smart card, digital signature or biometric. Authentication is the method of proving the identity, examples of authentication are, password or public key. Authorization is the method of determining if the authenticated user can perform the tasks or access the data requested.
As with any security control, a layered approach is often best. In the case of access control, these layers can be broken down as follows: Administrative controls, Physical controls and Logical controls (Technical Controls). Administrative controls consist of policies and procedures, personnel controls, separation of, rotation of supervisory structure, security awareness and testing. Physical controls consist of network segregation, perimeter security, computer controls, work area separation, data backups and cabling. Logical controls consist of system access, network architecture, network access, encryption and protocols, control zones (area that surrounds and protects network devices that emit electrical signals) and auditing. Within each of these layers mentioned, there are also further categories. Each of the mentioned layers also contains the following types of controls: preventative, detective, corrective, deterrent, recovery and compensating.
As specified previously, authentication is the method used to prove a claimed identity. On a general level, there are three types of authentication:
1. Something a person knows.
2. Something a person has.
3. Something a person is.
For a strong authentication process, two out of the three above must be used. The use of passwords is the most common authentication method but it is also one of the weakest. Some of the safeguards that can be taken against password attacks include, but are not limited to the following: using password generators, password aging (where passwords expire after a certain time period and the user is forced to change it), limit failed login attempts, Clipping Level (the number of failed login attempts before a user account is locked), and one-time passwords.
As mentioned earlier, authorization can be defined as the method by which the system or resource determines what level of access is to be granted to a user after that user has been identified and authenticated. The following are the basic guidelines that should be used to determine authorization: Trust or “need-to-know”, Roles or Groups, physical or logical location, time of day and transaction type. “Need-to-Know” is the lowest level of authorization required so that a given user, application, or process can fulfill its function; also referred to as least privilege. Roles can be defined as a certain set of responsibilities of a particular subject in an organization, and groups can be defined as various subjects categorized together based on certain needs or responsibilities. An example of physical location authorization restrictions would be a restriction where only a user logged into a system console, as opposed to remotely, can reboot the system. An example of logical location authorization would be a restriction that requires a user to connect from a certain IP address before they are able to perform certain tasks.
Access control models establish the framework that dictates how subjects access the system. The three main access control models are, Discretionary Access Control (DAC), Mandatory Access Control (MAC) and Nondiscretionary Access Control (Role-Based Access Control (RBAC)). Discretionary Access Control (DAC) enables the owner of the resource to specify what subjects can access specific resources and is based on the discretion of the resource owner. With Mandatory Access Control (MAC) users and data owners do not have as much freedom to determine who can access their files because it is based on data labels such as secret, confidential, and top secret. Nondiscretionary Access Control (Role-Based Access Control (RBAC)) uses a centrally administered set of controls to determine how subjects and objects interact is based on the user’s role and/or responsibilities in the organization and can be role-based, task-based, or lattice-based (provides an upper bound and lower bound for every subject and object relationship).
If these methods and technologies are used, correctly, and adhered to they can ensure Confidentiality, Integrity and Availability. These methods must be implemented with a final goal in mind; they cannot be thrown together without the final results in mind. They provide the needed division to ensure confidentiality. They also provide the needed integrity of the file systems to ensure accurate data retrieval. Finally they ensure data availability. Without Access Control Systems anyone would be able to access, modify and delete any data available on a particular system.
