3rd Lec - Part 2

Information
Security:
Principles and
Practice
Chapter 4: Access Control
Authorization  Are you allowed to do that?
Restrictions on actions of authenticated users
Authorization refers to the process of determining whether
a user, system, or application has the right or permission to
access a resource, perform an action, or use a service. It is a
critical aspect of access control and ensures that only
authorized entities can interact with protected resources.
Authorization is a form of access control
Access Control
“The prevention of unauthorized use of a resource,
including the prevention of use of a resource in an
unauthorized manner“
Central element of Information security
Assume have users and groups
◦ authenticate to system
◦ assigned access rights to certain resources on system
Access Control Principles
Access control policies
Discretionary access control (DAC)

Mandatory access control (MAC)
Role-based access control (RBAC)
Discretionary access
control (DAC)
A discretionary access control (DAC) policy is a means of

assigning access rights based on rules specified by users.
This class of policies includes the file permissions model
implemented by nearly all operating systems. In Unix, for
example, a directory listing might yield "... rwxr-xr-x ...
file.txt"
access control matrix
Mandatory Access
Control (MAC)
In this Model, users/owners do not enjoy the privilege of
deciding who can access their files. Here the operating
system is the decision maker overriding the user’s wishes.
Often employed in government and military facilities,
mandatory access control works by assigning a classification
label to each file system object. Classifications include
confidential, secret and top secret.
Role-based access control
(RBAC)
In RBAC, access decisions are based on the roles that

individual users have as part of an organization.
i.e Users take on assigned roles (such as doctor, nurse,
teller, or manager)
Developer
Access Control
Elements
Subject: entity that can access objects
◦ a process representing user/application
Object: access controlled resource

◦ e.g. files, directories, records, programs etc
Access right: way in which subject accesses an object

◦ e.g. read, write, execute, delete, create, search
Discretionary Access
Control
Often provided using an access matrix
◦ lists subjects in one dimension (rows)
◦ lists objects in the other dimension (columns)
◦ each entry specifies access rights of the specified subject to that
object
Access matrix is often sparse

Can decompose by either row or column
Access Control
Structures
To obtain acceptable performance for authorization operations, the
access control matrix can be partitioned into more manageable pieces.
There are two obvious ways to split the access control matrix.
Access control lists (decomposed by column)
Capability tickets (decomposed by row)
ACLs
First, we could split the matrix into its columns and store
each column with its corresponding object.
Then, whenever an object is accessed, its column of the
access control matrix would be consulted to see whether
the operation is allowed.
These columns are known as access control lists, or ACLs.
we could store the access control matrix by row, where
each row is stored with its corresponding subject.
Then, whenever a subject tries to perform an operation, we
can consult its row of the access control matrix to see if the
operation is allowed. This approach is know as capabilities,
or
C-lists.
An access matrix
Access matrix data
structures
Alternate
authorization
table
Role-Based
Access
Control
Access based on
‘role’, not identity
Many-to-many
relationship between
users and roles
Roles often static

Access control matrix can map users to roles and roles to
object.
Role-Based
Access
Control
Role-users and
roles-object
access matrix
Example of role
hierarchy
Director has most privileges
Each role inherits all privileges from lower
roles
A role can inherit from multiple roles
Additional privileges can be assigned to a
role
Mandatory access control
(MAC)
In Multi level security , the subjects are the

users (generally, human) and the objects are the data to be
protected (for
example, documents).
Furthermore, classifications apply to objects while
clearances apply to subjects.
The U.S. Department of Defense, employs four levels of
classifications and clearances, which can be ordered as
TOP SECRET > SECRET > CONFIDENTIAL > UNCLASSIFIED.

3rd Lec - Part 2

Uploaded by

Copyright:

Available Formats

3rd Lec - Part 2

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

3rd Lec - Part 2

Uploaded by

Copyright:

Available Formats

Information

Discretionary access control (DAC)

A discretionary access control (DAC) policy is a means of

In RBAC, access decisions are based on the roles that

Object: access controlled resource

Access right: way in which subject accesses an object

Access matrix is often sparse

Roles often static

In Multi level security , the subjects are the

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.