All right, let's take a look at module
four, which deals with identification, authentication and authorization.
So first concept access control.
Access control is the selective
restriction of an asset of access to an asset or numeric resource.
So this is dictated through an access attempt.
The authorization information determines whether or not the subject can access the
object and the allowance of the denial would be considered to be access control.
So controlling the flow of information between the subject and the object.
Access control.
All right, terminology.
The subject is the entity that accesses.
The object is the entity that is accessed.
Information flows from the object to the subject.
The reference monitor is invoked for every access attempt.
So think of referee reference.
When I try to access as a subject and
object, the reference monitor says hold on, not so fast.
Who are you?
Identification authentication.
Now what are you trying to access?
Let me check and see if you're authorized if you're authorized, thumbs up.
If you're not authorized, thumbs down.
It should be invoked for every access attempt and that's generally implemented
through the security kernel, the operating system.
Then the operation is representing the action taken by a subject on an object.
So you have actions, you have abilities,
and you have permissions, which are data flow.
So privileges are a combination of both
rights the ability to take action on an object permissions the ability to access
the object collectively privileges both rights and permissions.
All right, some access control principles.
More terminology.
Separation of duties involves a breakdown
of the authorization process into various steps.
Different privileges assigned at each step to individuals requesting for a resource.
Ensures that no single individual has the authorization rights to perform all
functions and simultaneously denies access to all objects to a single individual.
Long story short, you should never give
any one entity too much ability, right, because it gives them too much power.
It also makes them a single point of compromise.
If you have one person doing everything in
the network, what happens if they get hit by a bus?
Nobody there to perform the job duties.
So you'll see, separation of duties referred to inabilities and also job
tasks, permissions and access to resources.
You need to know you should only know what you need to know to do your job.
That goes hand in hand with the principle of least privilege, which means you should
only have enough to do your job and nothing more.
And that's the principle of least privilege.
So only enough access to do your job, no
more, no less, which is that's pretty hard to actually achieve, but we do our best.
So based on the need to know principle
all right, access Control models a mandatory access control.
Only the administrator system owner has rights to assign privileges.
Discretionary access Control end user has complete access to the information they
own and can provide access to other entities.
Role based access control.
Permissions are based on user roles.
So, for example, administrator, backup
operator, programmer, et cetera, et cetera.
Based on your job tasks.
Rule based Access Control are permissions
assigned dynamically based on a set of rules defined by the administrator.
And the best example that is not an identity based access control.
One of your better examples of rule based
access control are firewall rules or router access controllers.
All right, logical implementation of Mac and Rbac.
You're going to be doing labs on this.
So your Mac implementation user Account Control Tool of Windows OS.
This allows you to provide so logical
implementation of Access Control in general performed using Access Control
lists, group policies, passwords and account restrictions.
So you can use Mac User Account Control to
determine whether or not know after you're allowed to run the DAC.
Implementation is typically achieved
through Windows file permissions assignments or Access Control lists.
The role based access control can be implemented through just enough
administration can also be implemented through Windows Admin Center.
And again, you're going to be doing labs on all of those.
All four of those.