Chapter 3

1. Introduction to Access Control

Definition of Access Control:

- NISTIR 7298: The process of granting or denying specific requests to access and use information or enter physical facilities.

- RFC 4949: Regulates system resource use according to security policies, only permitting authorized entities (users, programs, or processes).

2. Access Control Principles

Core Principle:

- Access control is fundamental to computer security, as it ensures only authorized entities have access.

Subjects, Objects, and Access Rights:

- Subjects: Entities that request access (e.g., users or processes).

- Objects: Resources to be accessed (e.g., files).

- Access Rights: Permissions granted to subjects for objects.

3. Types of Access Control Models

1. Discretionary Access Control (DAC):

- Access is based on the identity of the requestor and their permissions.

- Often implemented using an access matrix where rows represent subjects and columns represent objects.

2. Mandatory Access Control (MAC):

- Compares security labels with security clearances.

- More rigid and suitable for environments with strict security requirements.

3. Role-Based Access Control (RBAC):

- Access is based on user roles within an organization.

- Roles are assigned permissions, and users acquire permissions based on their roles.

4. Attribute-Based Access Control (ABAC):

- Access is determined based on attributes (e.g., user, resource, environmental conditions).

- Provides flexibility by defining policies through combinations of attributes.

4. Traditional Access Control in UNIX Systems

UNIX File Access Control:

- User Identification (UID) and Group Identification (GID): Each user and file is associated with an ID.

- Protection Bits: Specify read, write, and execute permissions for the file owner, group members, and others.

- File Inodes: Contain the UID, GID, and protection bits for access control.

Advanced Features:

- SetUID and SetGID: Temporarily grant file owner/group rights during execution for specific programs.

- Sticky Bit: Applied to directories to ensure only the owner can modify or delete files within.

- Superuser: Has system-wide access, bypassing normal permissions.

Access Control Lists (ACLs) in UNIX:

- Allow more granular permission settings beyond basic protection bits.

5. Advanced Access Control Mechanisms

Protection Domains:

- Defines a set of objects and associated access rights.

- Can be static or dynamic, allowing for varied permissions based on user processes.

6. Identity, Credential, and Access Management (ICAM)

Purpose of ICAM:

- Ensures secure and trusted digital identity management for individuals and non-person entities (NPEs).

- Involves binding identities to credentials and using those credentials for authorized access.

Components of ICAM:

- Identity Management: Creation and maintenance of digital identities.

- Credential Management: Associating and maintaining credentials.

- Access Management: Regulating who has access to what within an organization.

Identity Federation:

- Trusting and exchanging digital identities between different organizations.

- Ensures seamless collaboration and secure access across organizations.

7. Summary of Access Control Policies

Key Models Reviewed:

- DAC: Flexible, identity-based, often used for simpler access management.

- MAC: Enforces strict control based on security labels, ideal for high-security needs.

- RBAC: Role-centric, efficient for organizational hierarchy-based access.

- ABAC: Attribute-based, allowing dynamic and context-aware access decisions.

UNIX Access Control Review:

- Includes basic permissions, advanced features (SetUID, SetGID, sticky bit), and superuser roles for extensive control.