Chapter 14: Controlling and Monitoring Access (Kiểm soát

và Giám sát Truy cập)

Tổng quan

Chương này thuộc Domain 3 (phần cryptanalytic attacks: Pass-the-Hash, Kerberos exploitation)
và Domain 5 (IAM — authorization mechanisms, privilege escalation, authentication systems).
Nội dung bao quát: phân biệt permissions/rights/privileges, các cơ chế authorization, 6 mô hình
access control (DAC, RBAC, Rule-based, ABAC, MAC, Risk-based), zero-trust access policy
enforcement, SSO trên Internet (SAML, OAuth, OIDC), SSO nội bộ (Kerberos, RADIUS,
TACACS+), và các tấn công access control (privilege escalation, password attacks, Kerberos
exploitation, sniffing, spoofing).

Các luận điểm chính

1. Permissions, Rights, và Privileges

• Permissions: Access granted cho object — read, write, delete, execute

• Rights: Ability to take an action trên system — VD: modify system time, restore backed-
up data

• Privileges: Kết hợp elevated rights + permissions — VD: administrator có full

privileges

2. Authorization Mechanisms (Cơ chế Ủy quyền)

• Implicit Deny (Deny by Default): Access denied trừ khi explicitly granted — nguyên
tắc nền tảng

• Access Control Matrix: Bảng tập trung subjects × objects × permissions. Mỗi object có
ACL riêng

• Capability List: Phân tán, tập trung vào subject (liệt kê objects mà subject có thể
access). ACL tập trung vào object (liệt kê subjects được access)

• Constrained/Restricted Interface: Ẩn/disable chức năng theo privileges user. Clark-

Wilson model implement concept này

• Content-Dependent Control: Restrict access dựa trên content bên trong object. VD:
database view chỉ hiện một số columns

• Context-Dependent Control: Yêu cầu hoạt động/bối cảnh cụ thể trước khi grant access.
VD: phải hoàn tất checkout flow trước khi download; date/time restrictions
 • Need to Know: Access chỉ khi cần cho work tasks — dù có clearance

• Least Privilege: Chỉ grant quyền tối thiểu cần thiết

• Separation of Duties: Chia sensitive functions cho ≥2 người — chống fraud/errors

3. Sáu Mô hình Access Control

3.1. Discretionary Access Control (DAC)

• Mọi object có owner → owner quyết định access. Implement bằng ACLs. Flexible, dễ
thay đổi. NTFS (Windows) dùng DAC.
• Identity-based access control = subset của DAC (assign ownership based on identity).

• Data owners có thể delegate cho data custodians.

3.2. Role-Based Access Control (RBAC)

• Dựa trên job roles/groups. Admin assign privileges cho roles, users inherit qua
membership. VD: group "Loan Officers" → add user = tự động có permissions.

• Prevent privilege creep: Remove user khỏi group = revoke tất cả group permissions
ngay lập tức.

• Users có thể thuộc nhiều roles. Roles theo organizational hierarchy.

• Task-Based Access Control (TBAC): Assign tasks thay vì roles. VD: Microsoft Project.

3.3. Rule-Based Access Control

• Global rules áp dụng cho tất cả subjects đều nhau. VD: Firewall ACL — rules +
implicit deny cuối cùng.

3.4. Attribute-Based Access Control (ABAC)

• Rules dùng multiple attributes — linh hoạt hơn rule-based. Attributes: user attributes
(group, department, device), network (LAN, wireless, WAN), devices (firewalls, servers).

• SDN thường dùng ABAC. Admin tạo policies bằng plain language: "Allow Managers to
access the WAN using a mobile device."

• MDM dùng context-aware attributes (time, device type, location).

3.5. Mandatory Access Control (MAC)

• Dùng labels trên cả subjects và objects. Subject phải có matching label để access object.

• Lattice-based model: Horizontal boundaries cho classification levels, vertical

compartments cho need-to-know.
 • Prohibitive, implicit deny. More secure than DAC but less flexible.

• Ba loại environment: Hierarchical (ordered — higher clearance = access lower levels),

Compartmentalized (isolated — no relationship between domains, need specific
clearance), Hybrid (hierarchical + compartments — Figure 14.2).

• Military labels: Top Secret > Secret > Confidential > Unclassified. Private sector:
Confidential/Proprietary > Private > Sensitive > Public.

3.6. Risk-Based Access Control

• Evaluate environment + situation + security policies (software code). Dynamic

decisions.

• VD: ER doctors = low risk → full patient data access. Pharmacy = medium risk →
limited access.

• Có thể yêu cầu MFA, compliant mobile devices. Có thể dùng machine learning cho
predictive conclusions.

4. Zero-Trust Access Policy Enforcement

• No trust boundary, no network edge. Continuous authentication, mọi action validated.

NIST SP 800-207.

• Components:

o Subject: User/service/system requesting access

o Policy Engine: Quyết định grant/deny/revoke dựa trên rules + external systems
(threat intelligence, identity management, SIEM). Dùng trust algorithm

o Policy Administrator: Component (không phải người) thiết lập/remove

communication path, tạo session-specific tokens

o Policy Decision Point (PDP) = Policy Engine + Policy Administrator

o Policy Enforcement Point (PEP): Forward requests, receive instructions.

Thường deploy với local client + gateway element

5. SSO trên Internet — SAML, OAuth, OIDC

SAML (Security Assertion Markup Language)

• Open XML-based standard cho authentication + authorization exchange. OASIS

standard (2005).

• 3 entities: Principal (user), Service Provider (SP/Relying Party), Identity Provider

(IdP/Asserting Party).
 • Flow: User → SP → redirect to IdP → authenticate → IdP sends SAML assertions
(XML) to SP → SP grants access.

• 3 loại assertion statements: Authentication (proof of credentials + login time), Attribute

(user info/entitlements), Authorization (authorized or denied + reason).

OAuth 2.0

• Authorization framework (NOT authentication protocol). RFC 6749.

• Dùng API messages + access tokens. VD: App nhận token từ social media site để post
thay user — không bao giờ share credentials.

• OAuth 2.0 không backward compatible với 1.0.

OpenID Connect (OIDC)

• Authentication layer trên OAuth 2.0 — cung cấp cả authentication VÀ

authorization.

• Dùng JSON Web Token (JWT) = ID token. Có thể include profile information.

• VD: Login eBay bằng Google account.

So sánh: SAML = XML-based, auth+authz+attributes. OAuth = authorization only, API+tokens.
OIDC = auth+authz, JSON Web Token, builds on OAuth 2.0.
6. SSO Nội bộ & AAA Protocols

Kerberos

• SSO authentication protocol, symmetric key (AES), tickets-based. Port 88.

• Components: KDC (trusted third party), Authentication Server (AS + TGS), Ticket (ST
— encrypted proof of authorization), TGT (proof of authentication, encrypted, includes
symmetric key + expiration + IP), Kerberos Principal (entity requesting ticket), Kerberos
Realm (logical area ruled by Kerberos).

• Login flow: User → plaintext username to AS → AS verifies → KDC generates session

key (encrypted with user's password hash) + encrypted timestamped TGT → Client
installs TGT + decrypts session key. Password NEVER transmitted.

• Resource access flow: Client sends TGT + request → KDC verifies TGT + checks
access matrix → TGS generates service ticket → Client sends ST to resource server →
Server verifies with KDC → Session opens.

• Weaknesses: KDC = single point of failure (compromised = all secret keys

compromised, offline = no auth). Time sync ≤5 minutes (via NTP — 1 DC syncs
external NTP, others sync with it).
RADIUS

• Centralized AAA cho remote access (VPN, dial-up). Network access server = RADIUS
client.

• UDP by default, only encrypts password (not entire session). RFC 2865. UDP 1812
(auth+authz), UDP 1813 (accounting). RFC 6614: RADIUS over TLS → TCP 2083.

• Supports callback security (terminate + call back predefined number).

TACACS+

• Cisco-developed, open standard. Separates AAA into individual processes (có thể 3
servers riêng). Encrypts entire session (not just password). TCP port 49.

7. Access Control Attacks

7.1. Privilege Escalation

• Horizontal: Gain similar privileges from other accounts (lateral movement)

• Vertical: Gain higher privileges (regular → admin)

• Managed service accounts: Nên tạo riêng với least privilege — KHÔNG dùng
LocalSystem (full admin = game over nếu exploited)

• su vs sudo (Linux): su = switch to root (needs root password, logs as su). sudo = run as
root using own credentials (logs as user — better auditing). Sudo group membership =
admin can audit sudo usage

7.2. Password Attacks

• Dictionary Attack: Predefined list of common passwords + one-upped variants
(password1, 1password)
• Brute-Force Attack: All possible combinations systematically. Hybrid = dictionary +
brute-force. GPU acceleration. Longer + complex = exponentially harder

• Spraying Attack: Same guessed password looped through many accounts slowly —
bypass account lockout (15-30 min loop < 30 min lockout timer)

• Credential Stuffing: Stolen credentials từ 1 site → automated try on hundreds of other

sites. Only works if user reuses credentials

• Birthday Attack: Exploit collision probability. Birthday paradox: 23 people → 50%

chance same birthday. Find 2 passwords with same hash. Defense: longer hash algorithms
(SHA-3), salts
 • Rainbow Table Attack: Precomputed hash database → compare hashes instantly instead
of computing. Salt (random bits added before hashing — Argon2, bcrypt, PBKDF2)
thwarts rainbow tables. Pepper (large constant stored elsewhere — config file/code) adds
further protection
7.3. Mimikatz

• Tool (2011, still maintained) exploiting SSO credential storage in memory. Capabilities:
read plaintext passwords/PINs from LSASS, extract Kerberos tickets, extract certificates
+ private keys, read LM/NTLM hashes, read cleartext passwords (if digest auth enabled),
list running processes. Có thể chạy fileless qua PowerShell (Invoke-Mimikatz).

7.4. Pass-the-Hash (PtH)

• Gửi captured hash (không cần biết password) đến authentication service. Primarily
NTLM/Kerberos.

• Flow: Mimikatz capture hashes từ [Link] → authenticate as user → lateral movement

(PsExec) → repeat on other systems.

• Admin recently logged on = game over — attacker gets admin hash.

7.5. Kerberos Exploitation Attacks

• Overpass the Hash (Pass the Key): Dùng NTLM hash request TGT khi NTLM disabled

• Pass the Ticket: Harvest tickets từ [Link] → inject để impersonate user

• Silver Ticket: Captured service account NTLM hash → forge TGS ticket → all service
account privileges

• Golden Ticket: Obtain KRBTGT account hash → create any ticket at will trong AD.
KRBTGT password never changes → hash never changes → learn once = persistent
access
• Kerberos Brute Force: [Link]/Rubeus guess passwords AND usernames (Kerberos
reports valid usernames)

• ASREPRoast: Target users without Kerberos preauthentication → request TGT →

offline decrypt to discover password

• Kerberoasting: Harvest encrypted TGS tickets → crack offline

7.6. Sniffer & Spoofing Attacks

• Sniffer Attack: Capture cleartext data (passwords, content). Defense: Encrypt all
sensitive data, use secure protocols (HTTPS, SFTP, SSH), one-time passwords, physical
security, IDS monitoring
 • Spoofing: IP spoofing (hide identity/impersonate trusted system), Email spoofing
(phishing), Phone number spoofing (VoIP caller ID falsification, same area code trick)

8. Core Protection Methods

Physical access control, electronic access control cho files, hash + salt + pepper passwords
(Argon2, bcrypt, PBKDF2), password masking, MFA deployment, account lockout controls
(clipping levels — VD: 5 wrong attempts), last logon notification, user security education.

Bài học / Takeaway

1. DAC = owner controls (flexible, less secure). MAC = labels (strict, more secure).
RBAC = roles/groups (practical, prevents privilege creep). ABAC = multi-attribute
rules (most flexible, SDN). Risk-based = dynamic evaluation with ML.

2. SAML ≠ OAuth ≠ OIDC: SAML = XML, auth+authz+attributes. OAuth = authorization

only via tokens. OIDC = auth+authz via JWT on top of OAuth. Đừng nhầm lẫn.

3. Kerberos là SSO nội bộ mạnh nhất nhưng KDC = single point of failure. Password
never transmitted but time sync critical (≤5 min). RADIUS encrypts password only
(UDP), TACACS+ encrypts entire session (TCP).
4. Golden Ticket = ultimate Kerberos attack — KRBTGT hash = create tickets at will.
Silver Ticket = service account compromise. Pass-the-Hash bypass password entirely.

5. Salt + Pepper passwords: Salt (random, stored with hash) thwarts rainbow tables.
Pepper (constant, stored separately) adds protection even if database stolen. Dùng
Argon2/bcrypt/PBKDF2.

6. Zero Trust: Policy Decision Point (Engine + Administrator) + Policy Enforcement

Point. Continuous validation, no inherent trust, mọi action checked against dynamic
policies.

7. Privilege escalation (horizontal + vertical) là bước mấu chốt trong mọi attack chain.
Dùng least privilege cho service accounts — KHÔNG dùng LocalSystem. Audit sudo
usage trên Linux.

8. Account lockout controls chống online attacks nhưng KHÔNG chống offline brute-
force/rainbow table attacks trên stolen databases.