Download - Access Control Presentation
Access Control
Muhammad Wajahat Rajab
• Protecting what needs to be protected with the available technologies!
• Access control is the of Information Security!
Overview
Some Questions
• What is Access?
• What is the Access Mechanism?
• What is Access Control?
• The right
• Flow of information between subject and object
• Mechanism to protect the assets!
Identification, Authentication, Authorization
Identification
Identification
• Method of establishing the subject’s identity
– User, Program, Process
• Use of username or other public information
• Identification component requirements…
– Each value should be unique
– Follow a standard naming scheme
– Non-descriptive of the user’s position or tasks
– Must not be shared between users
Authentication
Authentication
• Method of proving the identity
• How to prove an identity?
– Something you know
– Something you have
– Something you are
• Use of passwords, token, or biometrics other private information
• What is two factor authentication?
– Strong authentication
Something you know
• Traditional authentication method
• Passwords
– Protected string of characters
– Most widely used
– Types
• Cognitive passwords
• One time passwords (Dynamic passwords)
• Passphrase
Cognitive passwords
• Fact or opinion based information
• Created through several experience based questions
• Easy to remember!
– A person will not forget his birthplace, favorite color, dog's name, or the school he graduated from.
One time passwords
• Only used once
• Used in sensitive cases and places
• Examples include
– Prepaid cards
– Token devices
• Token device generates the one-time password for the user to submit to an authentication server
Passphrase
• Sequence of characters that is longer than a password --Thus a phrase
– User enters this phrase into an application which transforms the value into a virtual password
Attacks against passwords
• Electronic monitoring
• Access the password file
• Brute force attacks
• Dictionary attacks
• Social engineering
• Shoulder surfing
Something you have
• Requires possession of something such as a key, smart card, or some other device
• Examples include…
– Keys
– Documents
– Token devices
– Memory cards
– Smart cards
Token device
• Software hardware hybrid object used to verify an identity in an authentication process
• Token device, or password generator, is usually a handheld device that has an LCD display and possibly a keypad
– Token device is separate from the computer the user is attempting to access
Token Device – Benefits/Limitations
• Benefits
– Not vulnerable to electronic eavesdropping
• Wiretapping
• Sniffing
– Provide two factor authentication
• Limitations
– Human error
– Battery limitation
– Token itself (Environmental factors)
Types of Token Devices
• Synchronous Token
– A synchronous token device synchronizes with the authentication service by using time or a counter as the core piece of the authentication process.
• Asynchronous Token
– A token device using an asynchronous token generating method employs a challenge/response scheme to authenticate a user.
Synchronous Token
Asynchronous Token Device
Memory Card
• Holds information but cannot process
– A memory card can hold a user's authentication information, so that the user only needs to type in a UserID or PIN.
Smart Card
• Holds and processes information
• After a threshold of failed login attempts, it can render itself unusable
• PIN or password unlocks smart card functionality
• Smart card could be used for:
– Holding biometric data in template
– Responding to challenge
– Holding private key
Types of Smart Card
• Contact
– Requires insertion into a smart card reader with a direct connection to a conductive micro-module on the surface of the card (typically gold plated)
– Through these physical contact points, transmission of commands, data, and card status takes place
• Contactless
– Requires only close proximity to a reader
– Both the reader and the card have antenna and it is via this contactless link that two communicate
Smart Card attacks
• Micro-probing techniques
• Eavesdropping techniques
• Trojan Horse attacks
• Social engineering attacks
Something you are
• Special case of something you have
• Unique personal attribute is analyzed
• Encompasses all biometric techniques
– Fingerprints
– Retina scan
– Iris scan
– Hand geometry
– Facial scan
Biometric System
• A characteristic based system
– Includes all the hardware, associated software and interconnecting infrastructure to enable the identification/authentication process
• Uses individual's unique physical characteristics in order to identify and authenticate
– Each has its own advantages and disadvantages
Fingerprints
• Every person's fingerprint is unique
• Most affordable and convenient method of verifying a person's identity
• The lines that create a fingerprint pattern are called ridges and the spaces between ridges are called valleys.
Retina Scan
• Retinal scan technology maps the capillary pattern of the retina
– A thin (1/50th inch) nerve on the back of the eye!
• Accurate
• Many people are hesitant to use the device
Iris Scan
• Scans the iris or the colored portion of the eye
• For authentication the subject looks at the video camera from a distance of 3-10 inches
• The entire enrollment process is less than 20 seconds, and subsequent identification takes 1-2 seconds.
• Offers high accuracy!
Hand Geometry
• Measures specific characteristics of a person's hand such as length of fingers and thumb, widths, and depth.
• Takes over 90 measurements of the length, width, thickness, and surface area of a person's hand and fingers.
• Hand measurements occur with amazing speed, almost within one second.
• A charge coupled device (CCD) digital camera is used to record the hand's three dimensional shape.
Keyboard Dynamics
• Looks at the way a person types at a keyboard
• Also called Typing Rhythms!
• Keyboard dynamics measures two distinct variables:
– Dwell time: The amount of time one holds a particular key
– Flight time: The amount of time one moves between the keys
• Keyboard dynamic system can measure one's keyboard input up to 1000 times per second!
Voice Print
• A voice reference template is constructed
– To construct, an individual must speak a set of phrases several times as the system builds the template.
– Voice identification systems incorporate several variables including pitch, dynamics, and waveform.
Facial Scan
• Incorporates two significant methods:– Detection– Recognition
• Detection involves locating the human face within an image.
• Recognition is comparing the captured face to other faces that have been saved and stored in a database.
Facial Scan -- Process
Biometric Performance
• Biometric performance is most commonly measured in two ways:
– False Rejection Rate (FRR) – Type1
– False Acceptance Rate (FAR) – Type 2
• The FRR is the probability that you are not authenticated to access your account.
• The FAR is the chance that someone other than you is granted access to your account.
Crossover Error Rate
• Crossover Error Rate (CER) value is when Type 1 and Type 2 errors are equal.
– (Type 1 = Type 2 errors) = CER metric value
• System ABC has 1 out of 100 Type 1 errors = 1%
• System ABC has 1 out of 100 type 2 errors = 1%
• System ABC CER = 1
• The lower the CER value, the higher accuracy
• System with a CER of 5 has greater accuracy than a system with CER of 6
CER Concept
Authorization
Authorization
Controls
Types of Access Controls
• There are three types of Access Controls:
– Administrative controls
• Define roles, responsibilities, policies, and administrative functions to manage the control environment.
– Technical controls
• Use hardware and software technology to implement access control.
– Physical controls
• Ensure safety and security of the physical environment.
Administrative Controls
• Ensure that technical and physical controls are understood and properly implemented
– Policies and procedures
– Security awareness training
– Asset classification and control
– Employment policies and practices (background checks, job rotations, and separation of duties)
– Account administration
– Account, log monitoring
– Review of audit trails
Technical Controls
• Examples of Technical Controls are:
– Encryption
– Biometrics
– Smart cards
– Tokens
– Access control lists
– Violation reports
– Audit trails
– Network monitoring and intrusion detection
Physical Controls
• Examples of Physical Controls are:
– HVAC
– Fences, locked doors, and restricted areas
– Guards and dogs
– Motion detectors
– Video cameras
– Fire detectors
– Smoke detectors
Categories of Access Controls
• Preventive Avoid incident
• Deterrent Discourage incident
• Detective Identify incident
• Corrective Remedy circumstance/mitigate damage and restore controls
• Recovery Restore conditions to normal
• Compensating Alternative control
• Directive
Categories of Access Controls
Administrative Preventive Controls
• Policies and procedures
• Effective hiring practices
• Pre-employment background checks
• Controlled termination processes
• Data classification and labeling
• Security awareness
• Risk assessments and analysis
• Creating a security program
• Separation of duties
Administrative Detective Controls
• Job rotation
• Sharing responsibilities
• Inspections
• Incident response
• Use of auditors
Technical Preventive Controls
• Passwords
• Biometrics
• Smart cards
• Encryption
• Database views
• Firewalls
• ACLs
• Anti-virus
Technical Detective Controls
• IDS
• Reviewing audit logs
• Reviewing violations of clipping levels
• Forensics
Physical Preventive Controls
• Badges
• Guards and dogs
• CCTV
• Fences, locks, man-traps
• Locking computer cases
• Removing floppy and CD-ROM drives
• Disabling USB port
Physical Detective Controls
• Motion detectors
• Intrusion detectors
• Video cameras
• Guard responding to an alarm
Jotting them together…
Centralized Access Control Methodologies
Centralized Access Control Methodologies
• (ISC)2 discusses the following methodologies:
– RADIUS -- Remote Authentication Dial-In User Service
– TACACS -- Terminal Access Controller Access Control Systems
– DIAMETER
RADIUS
• Provides centralized authentication, authorization and accounting management for network services
• Works on a Client/Server model
• Functions:– To authenticate users or devices before granting them access to
a network
– To authorize users or devices for certain network services
– To account for usage of services used
RADIUS Process
RADIUS Implementation
TACACS
• TACACS has been through three generations:– TACACS, XTACACS and TACACS+
• TACACS uses passwords for authentication– TACACS+ allows users to use dynamic (one-time) passwords
– TACACS+ encrypts all the data
• TACACS uses UDP– TACACS+ uses TCP
TACACS at Work
Diameter
• "New and improved" RADIUS
• RADIUS is limited in its methods of authenticating users
• Diameter does not encompass such limitations
• Can authenticate wireless devices and smart phones
• Open for future growth
• Users can move between service provider networks and change their points of attachment
Single Sign-On Technologies
Single Sign On (SSO)
• A system that enables a user to access multiple computer platforms
• User logs in just once
• Access granted to permitted resources
• Login only required until after the user logs out
• Examples include:
– Kerberos
– SESAME
– Security Domains
– Thin Clients
Kerberos
• A computer network authentication protocol
– Allows principals communicating over a non-secure network to prove their identity to one another in a secure manner.
• Principals
– Any user or service that interacts with a network
– Term that is applied to anything within a network that needs to communicate in an authorized manner
Kerberos components
• Components of Kerberos– Key Distribution Center (KDC)
• Holds all of the principals' secret keys
• Principals authenticate to the KDC before networking can take place
– Authentication Server (AS)• Authenticates user at initial logon
• Generation of initial ticket to allow user to authenticate to local system
– Ticket Granting Service (TGS)• Generates of tickets to allow subjects to authenticate to each
other
Kerberos Process
SESAME
• Secure European System for Applications in a Multi-Vendor Environment
• Uses symmetric and asymmetric cryptographic techniques
• Uses Privileged Attribute Certificates (PACs)
• PACs are generated by the Privileged Attribute Server (PAS)
• After a user successfully authenticates to the Authentication Server (AS), the PAS then creates a PAC for the user to present to the resource that is being accessed!
SESAME Process
Security Domains
• Based on trust between resources or services on a domain that share a single security policy and single management
• The security policy defines the set of objects that each user has the ability to access
• A similar mission and single point of management responsibility
Security Domains -- Bull’s Eye View
Thin Clients
• Diskless computers are called dumb terminals or thin clients
• Client/Server technology forces users to log onto a central server just to be able to use the computer and access network resources.
• Server downloads the Operating System, or interactive operating software to the terminal
Access Control Models
Access Control Models
• Frameworks that dictate how subjects access objects
• Three Main Types
– Discretionary Access Control (DAC)
– Mandatory Access Control (MAC)
– Role Based Access Control (RBAC)
Discretionary Access Control
• Allows the owner of the resource to specify which subjects can access which resources
• Access control is at the discretion of the owner
• DAC defines access control policy
– That restricts access to files and other system resources based on identity
• DAC can be implemented through Access Control Lists (ACLs)
Access Control Matrix
• Access Control Lists (ACLs)
– Specifies the list of subjects that are authorized to access a specific object
• Capability Lists
– Specifies the access rights a certain subject possesses pertaining to specific objects
Access Control Matrix
Mandatory Access Control
• Based on security label system
• Users given security clearance and data is classified
• Used where confidentiality is of utmost importance
• MAC is considered a policy based control
• Every object and subject is given a sensitivity label– Classification level
• Secret, Top secret, Confidential, etc
– Category• Information warfare, Treasury, UN, etc
Mandatory Access Control
Subject Classification level Category
Umair Secret Finance
Tayyeb Secret HR
Object Classification level Category
Finance records Secret Finance
Employee records Secret HR
Role Based Access Control
• Uses centrally administered set of controls to determine how subjects and objects interact
• Decisions based on the functions that a user is allowed to perform within an organization
• An advantage of role based access controls is the ease of administration
• Capability tables are sometimes seen in conjunction with role-based access controls
• Best for high turn over organizations
Access Control Techniques
Access Control Techniques
• Rules Based Access Control
• Constrained User Interface
• Content Dependent Access Control
• Context Dependent Access Control
Penetration Testing
Muhammad Wajahat Rajab
ACE, CISSP (Associate), BS (TE)
Introduction
• Process of simulating attacks on Information Systems
– At the request of the owner, senior management
• Uses set of procedures and tools designed to test security controls of a system
• Emulates the same methods attackers use
Steps
• Discovery
• Enumeration
• Vulnerability mapping
• Exploitation
• Report to management
Step 1
• Discovery
– Gathering information about the target
– Reconnaissance Types
• Passive
• Active
Step 2
• Enumeration
– Performing port scans and resource identification methods
– Gaining specific information on the basis of information gathered during reconnaissance
– Includes use of dialers, port scanners, network mapping, sweeping, vulnerability scanners, and so on
Step 3
• Vulnerability Mapping
– Identifying vulnerabilities in identified systems and resources
– Based on these vulnerabilities attacks are carried out
Step 4
• Exploitation
– Attempting to gain unauthorized access by exploiting the vulnerabilities
Step 5
• Report to management
– Delivering to management documentation of test findings along with suggested countermeasures
Types
• Zero knowledge
• Partial knowledge
• Full knowledge
Questions
Question 1
• Which of the following refers to a series of characters used to verify a user's identity?
A. Token Serial number
B. UserID
C. Password
D. Security ticket
Question
• Which of the following refers to a series of characters used to verify a user's identity?
A. Token Serial number
B. UserID
C. Password
D. Security ticket
Question 2
• Which type of access control allows owners to specify who can access their files?
A. Discretionary
B. Relational
C. Mandatory
D. Administrative
Question
• Which type of access control allows owners to specify who can access their files?
A. Discretionary
B. Relational
C. Mandatory
D. Administrative
Question 3
• The three primary methods for authentication of a user to a system or network are?
A. Passwords, Tokens, and Biometrics
B. Authorization, Identification, and Tokens
C. Passwords, Encryption, and Identification
D. Identification, Encryption, and Authorization
Question
• The three primary methods for authentication of a user to a system or network are?
A. Passwords, Tokens, and Biometrics
B. Authorization, Identification, and Tokens
C. Passwords, Encryption, and Identification
D. Identification, Encryption, and Authorization
Thank You!