cissp access control part II

REMEMBER: CONTROL TYPESNOT HER CORRECTIVE PREVENTIVE DETECTIVE IT’S RIGHTPHOTOSHOP REMOVED... ∗ Preventive: firewall, ips, content-filtering, anti-x, access control matrix/rights, encry

• 3 CONTROLS

• 6 CONTROL TYPES

• COMMON MODELS

∗ DAC / MAC / RBAC:

∗ DAC  based on owner  access permission

∗ MAC  based on clearance  need to know

∗ RBAC  based on role

∗ Non RBAC: user  app1, app2

∗ Limited RBAC, user  app1  roleA, user  app2

∗ Hybrid: user  roleA  app1 + app2, user  app3  role

∗ Full: user  roleA  app1 + app2 + app3.

∗ ABAC (Attribute Based Access Control) *

REMEMBER: METHOD

REMEMBER: CONTROL TYPES

NOT HER

CORRECTIVE

PREVENTIVE

DETECTIVE

IT’S RIGHTPHOTOSHOP

REMOVED

∗ Preventive: firewall, ips, content-filtering, anti-x, access control matrix/rights, encryption, baseline, locks…

∗ Detective: ids, logs, monitor, anti-x, audit, log-review, SIEM

∗ Deterrence: sign (banner: will be monitored, no entry …)

∗ Corrective: backup/restore, load-balance, DRP…

∗ Recovery: focus restore process

∗ Compensative: change to new effective control

REMEMBER CONTROL TYPE

∗ Access Control risks/threats

∗ Disclosure of information

∗ Discuss 

Continue in part II

FIRST LINE DEFENSE

FIRST LINE DEFENSE (Cont)

WORK

FIRST LINE DEFENSE

PIGGY BACK

FIRST LINE DEFENSE

• Registered users checking

• BYOD controls

• Logs

TRUST BUT VERIFY

FIRST LINE DEFENSE

usernamepassword

Check

Information Disclousureinjection

FIRST + A HALF LINE DEFENSE 

This ID is used to perform administrative tasks

Warning and notify Monitors and logs

SECOND LINE DEFENSE

MISCONFIGURE WILL BE DANGEROUS BECAUSE OF HIGHEST PRIVILEGES

SECOND LINE DEFENSE

Virtual, at least privileges Defined Role

REMEMBER: SEPARATION OF DUTIES AND INHERITANCE OF PREVIOUS CONFIGURE

SECOND LINE DEFENSE

MUST PREVENT MOBILE CODE, SPOOF

(SIGNED…)

Delegated Access Rights

Addition Rules

Services

Grant/Den

y

Access Control Matrix (List)

AUTHORIZATION *

• Access Control Matrix:

clearances, check permissions…

• Services Grant/Deny: control sessions grant; time to re-check

• Addition rules: check some exception or explicit rules

COMBINE RBAC + ABAC

PLEASE ASK QUESTIONS!!!

IF YOU DON’T HAVE ANY QUESTONS, I WILL RAISE MY

QUESTIONS