itech9

From: CISSP Training Guide by Roberta Bragg

Confidentiality – Disclosure
Integrity – Alteration
Availability – Destruction

CIA: Confidentiality, Integrity, Availability
DAD: Disclosure, Alteration, Destruction (Denial)

Access control is the collection of mechanisms that permits managers of a system to exercise a directing or restraining influence over the behavior, use, and content of a system.

In most cases, you want to give the user the least amount of access he needs to do his job and nothing else. This concept is often referred to as the principle of least privilege. It gives you the power of combining authentication with access control.

The biggest problem with accountability is shared accounts.

Common access control techniques (types of access control)

• Discretionary access control
• Mandatory access control
• Lattice-Based access control
• Rule-Based access control
• Role-Based access control
• The use of access control lists

Discretionary access control
 Essentially based on human decisions.

Mandatory access control
 Based on using subject classification levels

Lattice-Based access control
 Based on graphs, partial order: reflexive, anti-symetric and transitive.

Rule-Based access control
 ACLs – a formalized rule-based control mechanism.

Role-Based access control
 Bell-LaPadula (BLP).
 .. confidentiality: is to prevent, detect, and deter unauthorized access to information..
 Simple security rule: Read Up No, Read Down Yes or RUN-RDY
 Star (or *) property: Write Up Yes, Write Down No or WUY-WDN
 Biba Model
 Deals with integrity ; opposite to BLP:
 Simple security: Read UP Yes, Read DOWN NO
 Star property: Write DOWN YES, Write UP Yes

The use of access control lists

Access Control Methodologies

 Centralized, Decentralized

Intrusion Detection (IDS)

 Methods and tools for monitoring networks and hosts and looking for attacks.

 IDS method types:

• Host/Network
• Passive/Active (listening, observing/collecting, scanning)
• Known/Unknown (types of attacks)

Types of attacks

• Monitoring
• Spamming
• Active
• Passive

A key motto of security (again) is: “prevention is ideal, but detection is a must.”

IDS technique types

• Signature matching
• Anomaly Detection

Most systems are based on signature detection with some anomaly detection.

Common tools: Nessus and nmap.