Security Concepts ( 2 )

Access Control

Access Control

An access control system ensures that an information system meets the goals of the CIA triad.

Access control governs how subjects/principals may interact with objects.

Subjects are people, devices, software processes, or any other system that can request and be granted access to a resource.

Objects are the resources. An object could be a network, server, database, app, or file.

Subjects are assigned rights or permissions on resources.

Modern access control is typically implemented as an identity and access management (IAM) system.

IAM comprises four main processes:

Identification—creating an account or ID that uniquely represents the user, device, or process on the network.

Authentication—proving that a subject is who or what it claims to be when it attempts to access the resource. An authentication factor determines what sort of credential the subject can use. For example, people might be authenticated by providing a password; a computer system could be authenticated using a token such as a digital certificate.

Authorization—determining what rights subjects should have on each resource, and enforcing those rights. An authorization model determines how these rights are granted. For example, in a discretionary model, the object owner can allocate rights. In a mandatory model, rights are predetermined by system-enforced rules and cannot be changed by any user within the system.

Accounting—tracking authorized usage of a resource or use of rights by a subject and alerting when unauthorized use is detected or attempted.

For example, if you are setting up an e-commerce site and want to enroll users, you need to select the appropriate controls to perform each function:

Identification—ensure that customers are legitimate. For example, you might need to ensure that billing and delivery addresses match and that they are not trying to use fraudulent payment methods.

Authentication—ensure that customers have unique accounts and that only they can manage their orders and billing information.

Authorization—rules to ensure customers can place orders only when they have valid payment mechanisms in place. You might operate loyalty schemes or promotions that authorize certain customers to view unique offers or content.

Accounting—the system must record the actions a customer takes (to ensure that they cannot deny placing an order, for instance).

Remember that these processes apply both to people and to systems. For example, you need to ensure that your e-commerce server can authenticate its identity when customers connect to it using a web browser.

For example, if you are setting up an e-commerce site and want to enroll users, you need to select the appropriate controls to perform each function:

Identification—ensure that customers are legitimate. For example, you might need to ensure that billing and delivery addresses match and that they are not trying to use fraudulent payment methods.

Authentication—ensure that customers have unique accounts and that only they can manage their orders and billing information.

Authorization—rules to ensure customers can place orders only when they have valid payment mechanisms in place. You might operate loyalty schemes or promotions that authorize certain customers to view unique offers or content.

Accounting—the system must record the actions a customer takes (to ensure that they cannot deny placing an order, for instance).

Remember that these processes apply both to people and to systems. For example, you need to ensure that your e-commerce server can authenticate its identity when customers connect to it using a web browser.

Security Controls

Information security and cybersecurity assurance is met by implementing security controls.

By identifying basic security control types, you will be better prepared to select and implement the most appropriate controls for a given scenario.

You should also be able to describe how specific job roles and organizational structures can implement a comprehensive security program for organizations.

Security Control Categories

Information and cybersecurity assurance usually takes place within an overall process of business risk management.

Implementation of cybersecurity functions is often the responsibility of the IT department.There are many different ways of thinking about how IT services should be governed to fulfill overall business needs.

Some organizations have developed IT service frameworks to provide best practice guides to implementing IT and cybersecurity.These frameworks can shape company policies and provide checklists of procedures, activities, and technologies that represent best practice. Collectively, these procedures, activities, and tools can be referred to as security controls.

A security control is designed to give a system or data asset the properties of confidentiality, integrity, availability, and non-repudiation. Controls can be divided into four broad categories based on the way the control is implemented:

Managerial—the control gives oversight of the information system. Examples could include risk identification or a tool allowing the evaluation and selection of other security controls.

Operational—the control is implemented primarily by people. For example, security guards and training programs are operational controls.

Technical—the control is implemented as a system (hardware, software, or firmware). For example, firewalls, antivirus software, and OS access control models are technical controls.

Physical—controls such as alarms, gateways, locks, lighting, and security cameras that deter and detect access to premises and hardware are often placed in a separate category to technical controls.

Security Control Functional Types

As well as a category, a security control can be defined according to the goal or function it performs:

Preventive-the control acts to eliminate or reduce the likelihood that an attack can succeed. A preventive control operates before an attack can take place. Access control lists (ACL) configured on firewalls and file system objects are preventive-type technical controls. Antimalware software acts as a preventive control by blocking malicious processes from executing,

Detective-the control may not prevent or deter access, but it will identify and record an attempted or successful intrusion. A detective control operates during an attack. Logs provide one of the best examples of detective-type controls.

Corrective--the control eliminates or reduces the impact of a security policy violation. A corrective control is used after an attack. A good example is a backup system that restores data that was damaged during an intrusion. Another example is a patch management system that eliminates the vulnerability exploited during the attack

While most controls can be classed functionally as preventive, detective, or corrective, a few other types can be used to define other cases:

Directive--the control enforces a rule of behavior, such as a policy, best practice standard, or standard operating procedure (SOP). For example, an employee's contract will set out disciplinary procedures or causes for dismissal if they do not comply with policies and procedures. Training and awareness programs can also be considered as directive controls.