Access Controls, Firewalls, and VPNs (INC)

Access Control

Method by which systems determines whether and how to admit a user into a trusted area of the organization

Mandatory Access Controls (MACS)

Use data classification schemes

Discretionary Access Controls (DACs)

Allow users to control and possible provide access to information/resources at their disposal

Identification

Mechanism whereby unverified entities seeking access to a resource (supplicants) provide a label by which they are know to the system

Authentication

The process of validating a supplicant’s purported identity

Password

A private word or combination of characters that only the user should know

Passphrase

A series of characters, typically longer than a password, from which a virtual password is derived

Dumb Card

ID or ATM card with magnetic stripe

Smart Card

Contains a computer chip that can verify and validate information

Authorization

The matching of an authenticated entity to a list of information assets and corresponding access levels

Accountability (auditability)

Ensures that all actions on a system-authorized or unauthorized- can be attributed to an authenticated identity

Access Control Architecture Models

Illustrate access control implementations and can help organizations quickly make improvements through adaptation

ITSEC

An international set of criteria for evaluating computer systems

Bell-LaPadula Confidentiality Model

Model of an automated system able to manipulate its state or status over time

Biba Integrity Model

Based on “no write up, no read down” principle

Graham-Denning Access Control Model

Composed of set of objects, set of subjects, and set of rights

Harrison-Ruzzo-Ullman Model

Defines method to allow changes to access rights and addition/removal of subjects/objects

Brewer-Nash Model

Designed to prevent conflict of interest between two parties

Firewalls

Prevent specific types of information from moving between an untrusted network (the Internet) and a trusted network (organization’s internal network)

SOCKS

The protocol for handling TCP traffic via a proxy server