Module 3: Risk Impact on Access Control

Fundamentals of Risk Assessment and Access Control

Role of Risk Assessment in Access Control Design:
- Risk assessment represents the critical first step when designing any access control system.
- The assessment process identifies potential threats and vulnerabilities within an existing system, prioritizes those findings, and determines practical methods to minimize or mitigate identified risks.
- An effective risk assessment accounts for both the intrinsic value of the assets requiring protection and the potential operational, financial, and organizational impact if those assets are compromised.
Core Definitions and Axioms:
- Inherent Nature of Risk: Risk is an unavoidable reality in information technology; no computing activity is completely risk-free. The objective of IT security is to minimize risk where feasible and mitigate remaining exposures.
- Risk: The probability that a specific threat will successfully exploit a vulnerability, resulting in harm or loss to an organization. Risk is formally quantified as a function of probability and impact.
- Asset Value ( $AV$ ): The relative worth—expressed either in monetary currency or qualitative terms—of a resource secured by an access control mechanism.
- Threat: A comprehensive list, category, or description of potential attacks or adverse actions directed against an asset.
- Vulnerability: An unintended weakness or flaw in system design, implementation, or operation that allows an attacker to seize control of a system, access unauthorized resources, or inflict damage.
- Probability of Occurrence: The mathematical or qualitative likelihood that a given threat actor will successfully target and exploit an existing vulnerability.
- Impact: The total magnitude of harm or loss experienced by an organization should a risk materialize.
- Control: Any technical, physical, or administrative mechanism, policy, or countermeasure implemented to reduce probability, impact, or both.
Fundamental Risk Equation:
- The standard formula used to determine the severity level of any risk is: $\text{Risk} = \text{Probability} \times \text{Impact}$
- Proportional Resource Allocation Examples:
- Desktop Printer: The probability of an unauthorized actor targeting a desktop printer is low, and the overall impact of such an exploitation is similarly negligible. Implementing a highly secure, three-stage access control architecture for a desktop printer is unjustified.
- Top-Secret Military Assets: Protecting top-secret military documentation using only a basic username and password logon mechanism is critically inadequate given the catastrophic impact of unauthorized exposure.
Systemic Nature of Risk:
- Risk is multifaceted and permeates every functional area of an organization.
- An individual user may formulate an exceptionally strong, complex password; however, the host system remains compromised if passwords are saved insecurely on the backend (e.g., in cleartext), or if unpatched operating system or application vulnerabilities allow adversaries to circumvent the access control mechanism entirely.

Access control model displaying Subject-User, Network-Object 3, Server-Object 1, and File on the Server-Object 2

Access Control Threats, Vulnerabilities, and Attack Vectors

Threat Variations Across System Architectures:
- System exposure depends directly on the function and exposure profile of the host platform.
- Web Servers: Highly vulnerable to Denial of Service ( $\text{DoS}$ ) attacks that disrupt public-facing availability.
- Database and Storage Servers: Systems housing proprietary or sensitive records are significantly more susceptible to data exfiltration, database injection, and credential impersonation attacks.
Characteristics of Vulnerabilities:
- Vulnerabilities encompass obscure defects in operating system kernels, application logic, and protocol implementations that grant attackers unauthorized traversal of low-level file structures.
- Vulnerabilities also encompass procedural and human weaknesses, including poorly chosen passwords, default configurations, and deficient physical security measures that allow physical access to network infrastructure.
- Broken Access Control: Vulnerabilities frequently manifest when software applications fail to enforce strict role-based access restrictions. For example, an administrative account requires permissions to create and provision new user accounts, whereas standard user accounts must be explicitly prohibited from executing those administrative functions.
Comparative Risk Analysis Scenario:
- High-Risk Scenario: A computer virus actively propagating across hundreds of external organizations, inflicting millions of dollars in lost operational productivity and destroyed records, possesses a high probability of occurrence and a high organizational impact. It demands an urgent, high-risk priority rating.
- Low-Risk Scenario: A poorly designed phishing email containing an embedded link that attempts to download a decade-old virus possesses a low probability (due to user recognition and modern spam filters) and a low impact (due to workstation endpoint antivirus definitions recognizing and neutralizing the obsolete payload).
- Risk Matrix Prioritization: Prioritizing mitigations involves plotting risks on an impact-versus-probability matrix, beginning remediation in the upper-right corner (high probability, high impact) and methodically working toward the lower-left corner (low probability, low impact).
Primary Access Control Threats:
- Password Cracking:
- Defined as guessing, deciphering, or reversing authentication secrets.
- System administrators establish rigorous complexity and expiration policies, but their enforcement is constrained by end-user demands for convenience and memorability.
- Attackers leverage automated brute-force attempts, dictionary attacks, and cryptanalytic algorithms, limited solely by computing power and available processing time.
- Storage Weaknesses: The primary vulnerabilities enabling password attacks are weak user selection and insecure credential storage. Historic legacy systems frequently retain credentials in plaintext flat files or unencrypted databases. Contemporary vulnerabilities arise from using deprecated, collision-prone, or unsalted hashing algorithms that fail to resist lookup tables and rainbow table extraction.
- Heightened Access (Privilege Escalation):
- Occurs when an attacker authenticates using low-privilege credentials and exploits an execution flaw to escalate privileges to administrative or root tiers.
- File and directory permissions normally isolate sensitive assets from general user accounts. Attackers bypass these logical barriers via memory corruption, buffer overflows, or configuration errors within applications or the operating system.
- Privileged Service Misconfigurations: A common vector involves running daemon services—such as Apache HTTP Server or Microsoft Internet Information Services ( $\text{IIS}$ )—under root or local system administrative accounts. Administrators sometimes do this to bypass file-writing and network-binding permissions, but this exposes the root credential context to remote exploitation if the web service is breached.
- Social Engineering:
- The systematic manipulation or deception of authorized human personnel to coerce them into executing unauthorized actions or disclosing confidential access credentials.
- Social engineering constitutes the most common attack strategy used to compromise hardened perimeters.
- Tailgating (Piggybacking): A physical security vulnerability where an unauthorized individual exploits the legitimate authentication of an authorized employee to bypass access gates. For example, during an 8:00 AM morning arrival rush, an attacker holding coffee, keys, and a box of doughnuts leverages social politeness to convince an authenticated employee swiping a smart card to hold open a perimeter door, allowing unauthenticated entry into internal facilities.

Quantitative and Qualitative Risk Assessment Methodologies

Quantitative Risk Assessment Mechanics:
- Employs deterministic mathematical models, historical loss data, and financial figures to calculate and rank organizational risk.
- Key Input Variables:
- Asset Value ( $AV$ ): Total financial replacement or operational value assigned to a given information asset.
- Exposure Factor ( $EF$ ): The specific percentage of asset value lost as the result of a realized threat event.
- Single Loss Expectancy ( $SLE$ ): The monetary loss realized each time an individual risk event occurs: $SLE = AV \times EF$
- Annualized Rate of Occurrence ( $ARO$ ): The estimated frequency with which a specific threat is projected to exploit a vulnerability over the course of a single year.
- Annualized Loss Expectancy ( $ALE$ ): The projected annual monetary loss resulting from a specific risk over a 12-month timeline: $ALE = SLE \times ARO$
- Worked Numerical Calculation:
- Consider a customer database consisting of $1{,}000$ sensitive records with an evaluated $SLE$ of $"\$50{,}000"$ per compromise event.
- If threat modeling predicts this database environment will be successfully breached twice per calendar year ( $ARO = 2$ ): ALE = \50{,}000 \times 2 = \ $100{,}000$
- The resulting $"\$100{,}000"$ figure establishes the annual financial ceiling for deploying security controls to protect the asset.
Qualitative Risk Assessment Mechanics:
- Evaluates system risk using subjective evaluation, scenario analysis, and expert consensus rather than numeric calculations.
- Cross-functional subject matter experts evaluate risk/asset pairings to assign relative probability scores and subjective impact ratings (e.g., low, medium, high).
- Qualitative outcomes fulfill the same prioritization role as quantitative $ALE$ figures, helping leadership allocate technical controls where critical assets intersect with extreme vulnerabilities.
Risk Response and Treatment Strategies:
- Risk Acceptance: A deliberate management decision to acknowledge a verified vulnerability without implementing technical safeguards, typically chosen when the financial or operational cost of controls exceeds the potential impact of exploitation.
- Risk Mitigation: The active implementation of administrative, physical, or technical safeguards to decrease the probability of occurrence, reduce operational impact, or eliminate the underlying vulnerability. This constitutes the default operational approach in information technology.
- Risk Transference: Reallocating the financial liability of a potential risk event to an external entity, most commonly achieved by purchasing dedicated cyber-liability insurance policies or outsourcing specialized infrastructure operations to managed third parties.

Value, Situation, and Liability in Access Control

Financial and Situational Impact:
- Determining asset value requires modeling the complete financial fallout of a worst-case scenario disaster to justify the baseline cost of protective access architecture.
- High-value assets exposed to elevated risk justify expensive, complex access controls, whereas low-value, low-risk endpoints warrant minimal security expenditures.
Legal Liabilities and Non-Financial Ramifications:
- System breaches frequently trigger criminal penalties, regulatory sanctions, and civil litigation.
- Highly regulated sectors—such as healthcare (e.g., patient health records) and commercial banking—face strict legal statutes imposing substantial punitive fines alongside criminal charges for corporate executives and security officers who demonstrate negligence in maintaining access controls.
- In high-compliance environments, non-financial outcomes (including mandatory imprisonment, license revocation, and permanent brand degradation) take operational precedence over standard financial loss models.
Access Control Prioritization and Grouping:
- Network architectures should leverage consolidated, centralized boundary checkpoints rather than deploying disparate, redundant access systems on individual low-level devices.
- A single perimeter access control gateway stationed at a network boundary can protect broad segments of underlying assets.
- Isolated, high-security controls are reserved specifically for segregated subnets housing high-value or highly sensitive intellectual property.

Network diagram illustrating access control points across workstations, switch, printer, server, firewall, and remote clients

High-Security Multilayered Frameworks (SCIF Case Model):
- Highly classified assets require deeply nested, concentric access boundaries.
- Sensitive Compartmented Information Facility (SCIF):
- Used by military and intelligence communities to safeguard classified information.
- Physical security boundaries include dedicated perimeters monitored by armed security guards, closed-circuit surveillance, and smart card badge readers.
- Internal zones enforce secondary multi-factor authentication; personnel must validate biometric characteristics (fingerprint analysis or retinal scanning) alongside complex usernames and passwords to unlock endpoints and access compartmented files.

The Seven Domains of IT Infrastructure and Multilayered Security

Defense-in-Depth Principles:
- Multilayered architecture strategically distributes access controls across all operational layers to compensate for budget, personnel, and technical constraints.
- Defense-in-depth is designed specifically to handle system failure: because any single security control will eventually fail, overlapping defenses ensure that a compromised outer perimeter simply leaves the attacker confronting an intact secondary barrier.

The seven domains of a typical IT infrastructure

Comprehensive Domain-by-Domain Security Architecture:
- 1. User Domain:
- The human element represents the primary target of deceptive exploitation.
- Controls: Mandatory security awareness training programs that instruct employees to identify social engineering attacks (e.g., phishing campaigns, tailgating, phone pretexting) and enforce strict password hygiene (generating high-entropy passphrases and executing scheduled rotations).
- 2. Workstation Domain:
- Represents individual user computing endpoints that interface directly with internal networks.
- Controls (Three Pillars):
  - Endpoint Antivirus Scanning: Scans incoming email attachments, active system memory, and files downloaded from external networks to quarantine malware before it spreads across local subnets.
  - Operating System Patching: Hardens internal system code against known common vulnerabilities and exposures ( $\text{CVEs}$ ), denying privilege escalation pathways to intruders who penetrate perimeter firewalls.
  - Host-Based Firewall: A local, software-defined firewall running directly on the client operating system to filter host-specific traffic, isolate services, and block unauthorized connection attempts.
- 3. Local Area Network (LAN) Domain:
- Encompasses internal switching, internal routing, endpoint interconnections, and local application servers.
- Controls:
  - Email Gateway Filtering: Inspects, sanitizes, and filters enterprise email at the boundary before delivery to client inboxes.
  - Server-Level Antivirus: Continuously monitors internal application and file servers for unauthorized modifications and malicious payloads.
  - Intrusion Detection Systems ( $\text{IDS}$ ): Passively monitors network traffic streams, parsing packets against known threat signatures and anomalous behavior to log incidents and assist post-incident forensic investigations.
  - Intrusion Prevention Systems ( $\text{IPS}$ ): Actively inspects inline network packet streams in real time, executing automated countermeasures—such as dropping malicious packets or reconfiguring firewall access-list entries—when suspicious signatures are detected.
  - Hybrid Systems: Modern installations combine both $\text{IDS}$ and $\text{IPS}$ into unified platforms that alert system administrators while dynamically enforcing programmatic blocks.
- 4. LAN-to-WAN Domain:
- The critical boundary interface connecting the private local network to external public network infrastructures (e.g., wide area networks or the Internet).
- Controls: Boundary firewalls serving as traffic arbiters that inspect, permit, or drop traffic flowing across public and private segments.

Firewall architecture controlling traffic between external systems and internal systems

Firewall Operational Classifications:
- Packet Filtering Firewalls: Operates statelessly, evaluating each packet header independently against a static access control list ( $\text{ACL}$ ) specifying source/destination IP addresses, protocols, and port numbers.
- Stateful Inspection Firewalls: Tracks the dynamic state of active layer-4 connections. Once a legitimate three-way handshake occurs, packets associated with the established connection pass without requiring repetitive, full rule-set comparisons.
- Application Gateways (Application-Level Firewalls): Deeply inspects payload traffic dedicated to explicit high-level protocols, such as File Transfer Protocol ( $\text{FTP}$ ) or Secure Sockets Layer ( $\text{SSL}$ ), making context-aware decisions based on protocol specifications.
- Proxy Servers: Terminates incoming and outgoing connections, effectively masking internal network topologies and client IP addresses from the public Internet. Organizations deploy proxy appliances to monitor employee browsing habits, block malicious Uniform Resource Identifiers ( $\text{URIs}$ ), restrict blacklisted search terminology, or permit only explicit whitelisted web destinations.
- 5. Remote Access Domain:
Governs external endpoints connecting to internal corporate resources over untrusted public transit paths.
Controls:
- Virtual Private Network ( $\text{VPN}$ ): Securely bridges remote endpoints to enterprise networks by creating logical tunnels over public Internet architectures.
- Internet Protocol (IP) Tunneling: Encapsulates complete underlying data packets inside new, fully routable IP packets, encrypting and routing them securely through intermediary transit networks.
- Cryptographic Assurance: Encrypted $\text{VPN}$ connections over the public Internet frequently provide stronger confidentiality and integrity than raw, unencrypted transmissions passing over internal physical local area networks.

VPN architecture utilizing IP tunneling across the Internet to connect a remote client through a VPN firewall to the internal network

6. Wide Area Network (WAN) Domain:
- Encompasses broader regional or global communication backbones, telecom routing, and external carrier infrastructure linking dispersed enterprise campuses and remote endpoints to core data centers.
7. System/Application Domain:
- Encompasses the central operating software, enterprise resource planning suites, web applications, and database engines hosting operational corporate workloads.
- Controls and Patch Management Procedures:
- Security teams must track vendor security bulletins, catalog newly released patches, and perform rigorous pre-deployment staging.
- Automated Patch Management Platforms: Enterprise tools automate discovery and distribution across disparate software ecosystems, reducing administrative burden.
- Patching Cautions and Library Conflicts: Automatically deploying vendor patches upon release introduces severe operational risks. Updates frequently modify operational logic or overwrite shared Dynamic-Link Libraries ( $\text{DLLs}$ ) and code dependencies relied upon by third-party internal tools.
- Staging and Regression Testing: In heavily regulated sectors, all patches must undergo complete isolation testing inside sandboxed non-production staging environments. Testing regimens require formal user acceptance testing ( $\text{UAT}$ ) and automated regression sweeps to verify that resolving one vulnerability does not crash legacy shared dependencies.
- Cost-Benefit Governance: When an application update does not resolve a documented critical security flaw or supply mission-critical capabilities, extensive testing costs can easily outweigh the marginal defensive value. In such cases, security teams deliberately bypass or delay patch installation.