Cy

Introduction

  • Prayer: Acknowledges the impact of Jesus's sacrifice for access and knowledge in the context of access controls for practical application in upcoming semesters.

Access Control Overview

  • Discusses the concept of access controls divided into several categories based on factors: "what you know," "what you have," "what you are", etc.

Types of Access Control Factors

What You Know

  • Consists of username, password, etc.

What You Have

  • Tokens and Cards:

    • Synchronized Tokens: Time-based tokens generating random numbers synced with the server (changes every 2, 4, 8, or 24 hours).

    • Example: Used in industrial organizations like ConocoPhillips and Chevron.

    • Security features and real-world effectiveness discussed.

    • Event-Based Synchronization:

    • Triggered by user actions (e.g., captcha verification).

    • Continuous Authentication: Remains connected while the user’s session is active.

    • Asynchronous Tokens: Include USB keys and smart cards which grant access when inserted.

    • Example: Used frequently by government agencies and military for secure access.

Authentication and Access Mechanics

  • Authentication Process:

    • User requests access with ID.

    • Server replies with a challenge (PIN/password).

    • User authenticates using a mobile authenticator, submitting further verification to the server for access.

    • Multi-Factor Authentication (MFA): Combines user ID/password with additional methods (e.g., mobile authenticator).

Biometrics in Access Control

Overview of Biometrics

  • Biometrics include physical or behavioral characteristics used to authenticate.

Characteristics

  • Static: Biometric traits such as fingerprints are fixed.

  • Dynamic: Behavior-based elements (actions performed by the user) can vary.

Accuracy and Practicality Issues

  • Discussion of the reliability of facial recognition systems versus other biometric methods.

  • Concerns:

    • Accuracy issues with various biometric methods (e.g., false positives with facial recognition).

    • Potential for system errors affecting reliability.

Types of Biometric Systems

  • Fingerprint Recognition: Common in laptops and mobile devices.

  • Facial Recognition: Predominantly used due to existing hardware in mobile devices.

  • Other Types: Palm prints, hand geometry, retinal scans, iris scans, voice patterns, keystroke dynamics, signature analysis are discussed regarding their practical usage and limitations.

Additional Access Control Concepts

Location-Based Controls

  • Use of location data for verifying user authenticity with mobile devices discussed.

  • The ethical implications of location tracking and user privacy.

Role-Based Access Control (RBAC)

  • Single Sign-On (SSO): Simplifies access across multiple systems (reduces human error).

  • Importance of communication between systems to successfully implement SSO (example of HCU's LetMeIn app).

  • Technologies used: Kerberos, SESAME, LDAP for authentication and access management.

Policies and Procedures

  • Importance of log files in cybersecurity to enforce accountability.

  • Roles of monitoring and reviewing access to ensure compliance and data protection.

  • Discusses data retention policies and secure media disposal practices.

  • Compliance with cyber security regulations significant to avoid financial penalties following breaches.

Formal Modes of Access Control

Types Discussed

  • Discretionary Access Control (DAC): Permissions granted at the discretion of a user (e.g., administrator).

  • Mandatory Access Control (MAC): User role dictates permissions set by policy.

  • Non-Discretionary Access Control: Fixed limitations applying across user roles.

  • Rule-Based Access Control: Access determined by predefined rules based on user roles.

Access Permission Schemes

Permissions in Operating Systems

  • Linux and Mac OS: Permissions of Read, Write, Execute.

  • Windows OS Permissions: Permissions include Full Control, Modify, Read, and Deny, with additional system-specific rules.

Access Control Lists (ACL)

  • Concept of ACL where files/folders permissions may differ by the user/group.

  • Practical examples of various user scenarios concerning access restriction.

Threats to Access Control

  • Discussed types of threats including physical access breaches, eavesdropping, bypassing security measures, and exploiting software vulnerabilities.

Effects of Control Violations

  • Loss of customer confidence, business opportunities, potential legal repercussions, and financial penalties.

Conclusion and Q&A

  • Emphasizes the importance of access control as one tool among many in cybersecurity. Discussed the intricacies of each aspect of access management, their practical implications, and the ethical considerations involved in modern computing environments.

  • Questions addressed concerning static and dynamic access controls, compliance matters, and the role of privacy policies.

Cloud Computing

  • Types of cloud computing: private, community, public, and hybrid.

  • Advantages include reduced need for physical infrastructure and outsourced maintenance.

  • Disadvantages involve security complexities and reliance on external vendors for data protection.

Privacy Policies and Acceptable Use Policies (AUP)

  • Importance of AUP in establishing user expectations for data handling, monitoring, and access control.