n Learn how to implement identity management controls n Learn how to implement access management controls n Prevent unauthorized access

Transcription

1 Chapter Objectives Lear how to implemet idetity maagemet cotrols Lear how to implemet access maagemet cotrols Chapter #20: Idetity ad Access Maagemet 2 Idetity ad Access Maagemet Cotrols All actios will be cotrolled via a system of approvals: accessig a resource operatig o a resource storig of a item Idetity ad access maagemet systems establish a lik Access Cotrol Models Prevet uauthorized access Grat or dey access Autheticatio vs. access cotrol Access cotrol matrix Access cotrol lists (ACLs) betwee users ad accouts, ad cotrol what users ca do madatory access cotrol (MAC) with resources, which actios are allowed, which actios are deied discretioary access cotrol (DAC) attribute=based access cotrol (ABAC) role-based access cotrol (RBAC) 3 4 rule- based access cotrol (RBAC) CIS

2 Madatory Access Cotrol (MAC) Discretioary Access Cotrol (DAC)... a meas of restrictig access to objects based o the sesitivity (as represeted by a label) of the iformatio cotaied i the objects ad the formal authorizatio (i.e., clearace) of subjects to access iformatio of such sesitivity. Clearace... a meas of restrictig access to objects based o the idetity of subjects ad/or groups to which they belog. The cotrols are discretioary i the sese that a subject with a certai access permissio is capable of passig that permissio (perhaps idirectly) o to ay other subject.... Liux permissios (RWX) Labels Multilevel security eed to kow least privilege 5 6 Attribute-Based Access Cotrol (ABAC) Role-Based Access Cotrol (RBAC) Attribute-based access cotrol (ABAC) is a form of access cotrol based o attributes user, resource, object, ad evirometal attributes The major differece betwee ABAC ad role-based access The roles are assiged the access permissios ecessary to perform the tasks associated with the role Users will thus be grated permissios to objects i terms of the specific duties they must perform cotrol is the ability to iclude Boolea logic i the access cotrol decisio 7 8 CIS

3 Effective Rights Rule-Based Access Cotrol (RBAC) Rule-based access cotrol uses objects such as ACLs to determie whether access should be grated or ot This methodology is used for firewalls, proxies, switches, routers, ati-malware, IDS/IPS, ad more Each packet is preseted to the cotrol device, ad the predefied set of rules is applied ad iterpreted 9 10 Firewall Rules Physical Access Cotrol Physical access cotrol defiig ad eforcig who ca have physical access to a system Access lists defie the group of idividuals who are authorized to utilize a resource - etry ito a server room Orgaizatios use electroic access cotrol systems electroic door strikes ad magetic locks Security is improved by havig a cetralized system They allow loggig of etry, auditig movemets, ad real-time moitorig CIS

4 Proximity Cards Smart Cards Proximity cards, or cotactless access cards ca be combied with a keypad, or a separate PIN code These devices rely o a electroic sigal from the cotrol pael to release the mechaism Security is improved by havig a cetralized system They allow loggig of etry, auditig movemets, ad realtime moitorig A smart card (itegrated circuit card [ICC] or chip card) a credit card-sized card with embedded itegrated circuits They ca carry log cryptographic tokes, too log to remember ad too large a space to guess Combie somethig you kow (a pi or password) with somethig you have (ad ca t be duplicated, a smart card) Stadard corporate-type laptops come with smart card readers istalled ad their use is itegrated ito Widows Biometric Factors Figerprit Scaer Measuremets of certai biological factors that are uique Figerprit, retia or iris of the eye, geometry of the had, ad geometry of the face, (palm) vei map Erollmet: a computer takes the image of the biological factor ad traslates it to a umeric value called template A figerprit scaer measures the uique patter of a perso s figerprit Oe of the challeges is that they do t fuctio if the user is wearig gloves (e.g., medical gloves) or has wor off their figerprits through maual labor Autheticatio: the biometric feature is scaed ad the computer computes a value i the same fashio as the template aalog-digital coversio CIS

5 Retial Scaer Iris Scaer A retial scaer examies blood vessel patters i the back of the eye Suffers from lack of user acceptace, as it ivolves laser This detectio requires the user to be right i frot of the device for it to work More expesive because of the precisio of the detector ad the ivolvemet of lasers A iris scaer similar to a retial scaer Pigmetatio i the iris of the eye ca be photographed ad measured from a distace It s easy to do without a perso s kowledge, ad eve costruct cotact leses that mimic a patter There are some issues associated with medical coditios such as pregacy, ad some diseases detectig ad revealig chages i a perso s iris would be a privacy violatio Voice Recogitio Facial Recogitio Voice recogitio is the use of uique toal qualities ad speech patters to idetify a perso This biometric has bee oe of the hardest to develop ito a reliable mechaism false acceptace ad rejectio rates Facial recogitio a sesor that recogizes whe you move the phoe i a positio to see your face, coupled with a state of ot logged i Has a fairly high discrimiatio, ad works fairly well Aother perso ca move the phoe i frot of the registered user ad it ca ulock For certai trasactios the positio of the phoe ad NFC locatio eed to be i a certai orietatio CIS

6 False Positives ad False Negatives False Acceptace Rate A false positive system allows access to someoe who is ot authorized A false egative system deies access to someoe who is actually authorized Miimize the existece of both false positives ad false egatives The false acceptace rate (FAR) what level of false positives are goig to be allowed i the system Threshold or better a accept sigal will be give If you are ot a match i the gray area, you will become a false positive FAR - probability that the system icorrectly idetifies a match False Rejectio Rate Crossover Error Rate The false rejectio rate (FRR) what level of false egatives are goig to be allowed i the system Threshold or lower a reject sigal will be give If you are a match i the gray area, you will become a false egative Choice of which error rate is more importat The crossover error rate (CER) is the rate where both accept ad reject error rates are equal This is the desired state for most efficiet operatio, ad it ca be maaged by maipulatig the threshold value I practice, the values may ot be exactly the same CIS

7 Biometrics Calculatio Example Tokes The lower the FAR ad FRR, the better the system Ideal situatio is settig the thresholds where the FAR ad FRR are equal, at the crossover error rate Remember to iclude those that fail erollmet Toke is a physical object, a somethig you have factor Keys are paired exclusively with a lock or a set of locks; ot easily chaged; difficult to give selective access; difficult to take access away - rekey Frequecy cards, proximity readers, smart cards Oly the toke is beig idetified ad ot who carries it Combied with multifactor autheticatio Hardware Software USB tokes, key fobs, RFID chips FIDO Alliace Yubikey Access tokes may also be implemeted i software Software tokes provide two-factor autheticatio but do t require a separate physical device o had Some tokes require software cliets that store a symmetric key Other software tokes use public key cryptography A user must supply the correct PIN that is stored o a remote server CIS

8 HOTP/TOTP Certificate-Based Autheticatio HMAC-based Oe-Time Password (HOTP) a algorithm that ca autheticate a user usig a autheticatio server HMAC Hash-based Message Autheticatio Code Time-based Oe-Time Password (TOTP) a specific implemetatio of a HOTP that uses a secret key with a curret timestamp to geerate a oe-time password Certificate-based autheticatio offers a method of establishig autheticity of specific objects such as a idividual s public key or dowloaded software A digital certificate is a file that is set as a attachmet to a message ad is to verify that the message did ideed come from the etity it claims to have come from This ca become a reliable meas of idetificatio, especially whe combied with a additioal factor such as somethig you kow or a biometric PIV/CAC/Smart Card IEEE 802.1x Persoal Idetity Verificatio (PIV) card is a U.S. govermet smart card that cotais the cardholder s credetial data to access to federal facilities ad iformatio systems The Commo Access Card (CAC) is a smart card used by the U.S. Departmet of Defese (DoD) for active-duty military, Selected Reserve members, DoD civilias, ad eligible cotractors It is used for carryig the cardholder s credetial data, i the form of a certificate IEEE 802.1X is a a u th e tica tio sta d a rd th a t su p p o rts p o rt- based autheticatio services It is used by all types of etw orks, icludig Etheret, Toke Rig, ad w ireless This stadard describes m ethods used to autheticate a user prior to gratig access 802.1X acts through a iterm ediate device, such as a edge switch, eablig ports to carry orm al traffic if the coectio is properly autheticated Util a cliet has successfully autheticated itself to the device, oly Extesible Autheticatio Protocol over LAN (EAPoL) traffic is passed by the sw itch CIS

9 File System Security Database Security File system s eed a m ethod of applyig security, to prevet uauthorized access ad uauthorized alteratios File system security esures this critical fuctio Combiatio of file storage mechaisms, access cotrol lists ad access cotrol models You eed a file system capable of supportig user- level access differetiatio (N TFS but ot FAT32) Next you eed a access cotrol model, such as MAC, DAC, or ABAC The you eed a system to grat users permissios to access ad modify files, which ca be hadled by the OS This is doe through the ier workigs of the file system ad is ivisible to the user users will ot see files they caot access Database security is the applicatio of security fuctios, who ca access what, iside a database system Major database egies have built-i access cotrol provisios ad ecryptio capabilities The results are eforced via ecryptio The advatage is that they ca be tailored to the data structure, protectig the essetial colums while ot impactig colums that are ot sesitive Data schema ad its security eed to be desiged ito the database implemetatio performace hit is typically egligible There is o 100 percet secure system, ad there is othig that is foolproof! Stay Alert! CIS