337: access control

access control - introduction

mechanisms that regulate who/what can access which resources under what conditions

subject

user, group, process, service

object

file, database, API, VM

operation

read, write, execute, delete

access control question

can Subject S perform Operation O on Object R?

components: identification

claiming an identity

components: authentication

verifying identity

components: authorization

determining what an authenticated user is allowed to do

components: access

once authenticated and authorized, the subject can access the resource

components: accountability

used as part of access control to enforce least privilege

components: manage

adding/removing authentication and authorization of users or systems

RBAC —> role-based access control

controls access based on the roles that users have within the system and on rules stating what accesses are allowed to users in given roles

ABAC —> attribute-based access control

controls access based on attributes of the suer, the resource to be accessed, and current environmental conditions

DAC —> discretionary access control

control access based on the identity of the requestor and access rules (authorizations) stating what requestors are/not allowed to do

aka: subjects can determine who has access to their objects

MAC —> mandatory access control

controls access based on comparing security labels with security clear

subject

an entity capable of accessing objects

three classes: owner, group, world

object

a resource to which access is controlled

entity used to contain and/or recieve info

acess right

describes the way in which a subject may access an object

could include: read, write, execute, delete, create, search

access control matrix (acm)

determines who can access an object, what objects can be accessed by a subject, what operations a subject can perform on an object

using a 2d matrix organized by subjects and objects indicating what actions individual subjects can take upon individual objects

access control list (acl)

each object has a list specifying which subjects can access it and what operations they can perform

capability lists

opposite of an acl, a list organized by which subjects can access which files

unix file access control