Cyber Security Management
c
3. Access control
Sosina M.
1
Access control
❑Ensures that unauthorized users don't get into the system, protects password data and
keeps track of who's doing what in the system.
❑System access controls
▪ ensure that unauthorized users don’t get into the system
❑Data access controls
▪ monitor who can access what data, and for what purpose
Cybersecurity Management 2
System Access: Logging into Your System
❑The first way a system provides computer security is by controlling access to that
system.
▪ Who’s allowed to log in?
▪ How does the system decide whether a user is legitimate?
▪ How does the system keep track of who’s doing what in the system?
❑Trying to log into a system is a kind of challenge/response scenario.
▪ You tell the system who you are, and the system requests that you prove it by providing
information that matches what the computer has stored about you.
o In security terms, this two-step process is called identification and authentication.
Cybersecurity Management 3
Identification and Authentication
❑Identification is the way you tell the system who you are.
❑ Authentication is the way you prove to the system that you are who you say you are.
❑Methods
▪ What you know (E.g., a password, pin code)
o if you know the secret password for an account, you must be the owner of that account.
o But, you might give your password away or have it stolen from you. If you write it down, someone
might read it.??
▪ What you have (E.g., keys, tokens, badges, and smart cards)
▪ What you are (E.g., fingerprint, handprint, retina pattern, voice, signature, or keystroke
pattern)
o Biometric systems compare your particular trait against the one stored for you and determine
whether you are who you claim to be.
o Problems sometimes occur with false positives and false negatives
Cybersecurity Management 4
Identification and Authentication
❑Multifactor authentication
❑a way to cascade the three methods such that if an attacker gets past one safeguard,
they still have to pass another
❑username and password would be augmented with one of the other two systems
Cybersecurity Management 5
Login Processes
❑In most systems, you identify yourself to the system by entering some kind of unique
login identifier or username, followed by a password.
❑The password is typically a string of letters and/or numbers known only to you
❑The method of the username/password authentication process involves one or more of
the following
❑Encryption
▪ This method scrambles a password so that it cannot be deciphered by someone who
monitors storage or transmissions.
▪ The opposite of encryption is clear text, in which password or other information is
transmitted unmodified.
❑Challenge and response
▪ With this method, the user is asked to authenticate at the beginning of the exchange, and
frequently at random intervals thereafter
Cybersecurity Management 6
Password Authentication Protocol (PAP)
❑In Password Authentication Protocol (PAP)
▪ the user provides a username and password
▪ compared with values stored in a table to see if they match.
❑Login information is transmitted in the clear, that is, unencrypted, or using clear text
Cybersecurity Management 7
Challenge Handshake Authentication Protocol (CHAP)
❑ The Challenge-Handshake Authentication Protocol (CHAP) is used to periodically
verify the identity of the peer using a 3-way handshake.
❑This is done upon initial link establishment, and MAY be repeated anytime after the
link has been established.
▪ After the Link Establishment phase is complete, the authenticator sends a "challenge"
message to the peer.
▪ The peer responds with a value calculated using a "one-way hash" function.
▪ The authenticator checks the response against its own calculation of the expected hash
value.
▪ If the values match, the authentication is acknowledged; otherwise the connection
SHOULD be terminated.
▪ At random intervals, the authenticator sends a new challenge to the peer
Cybersecurity Management 8
One-time password
❑The one-time password (OTP) is a variation of the username/password combination.
❑The method of delivering the OTP may be a proprietary token, via mobile phone, on
paper or a web-based approach
❑The user begins with a secret w and a constant t, defining the number of
identifications to be allowed.
❑A one-way function (OWF) H is used to define the password sequence: w0= Ht(w),
Ht-1(w), Ht-2(w), …, Ht-i(w).
❑The password for the ith identification session, 1<i< t, is defined to be wi = Ht-i(w)
Cybersecurity Management 9
Tokens
❑A token or token card is usually a small device that supplies the response to a
challenge that is received when trying to log on
❑At login, the server issues a challenge with a number.
▪ The user keys this number into the token card, and the card displays a response.
▪ The user inputs this response and sends it to the server, which calculates the same result it
expects to see from the token.
❑Other tokens are based on time.
▪ They display a number that changes at regular intervals, usually several times each hour.
▪ The user logs in by entering username and password, along with the time-based value
from the token.
Cybersecurity Management 10
Biometrics
❑Uses personal measurements such
▪ fingerprint
▪ voice
▪ retinal scan
▪ iris scan
❑Variable biological characteristics:
▪ finger wound
▪ voice altered due to emotion
▪ retinal blood pattern altered due to alcohol or drug
❑Prone to false positives (saying you are who you aren’t) and false negatives (saying
you aren’t who you are), and most systems have an index of reliability that is
calculated by combining the two ratios
Cybersecurity Management 11
Kerberos
❑Kerberos provides a means of verifying the identities of principals, (e.g., a
workstation user or a network server) on an open (unprotected) network.
❑performs authentication as a trusted third party authentication service by using
conventional (shared secret key) cryptography
❑Implementation of the basic protocol consists of one or more authentication servers
running on physically secure hosts.
▪ The authentication servers maintain a database of principals (i.e., users and servers) and
their secret keys.
Cybersecurity Management 12
Kerberos authentication process
❑A principal consists of the three-tuples <primaryname, instance, realm>
▪ For a user - primary name= login identifier, the instance=either null or represents
particular attributes of the user, i .e., root .
▪ For a service, primary name= service, machine name is used as the instance, i.e., rlogin
.myhost .
▪ The realm is used to distinguish among different authentication domains
❑Kerberos principals may obtain tickets for services from a special server known as the
ticket-granting server (TGS).
❑A ticket contains assorted information identifying the principal, encrypted in the
private key of the service.
{𝑻𝒄, 𝒔}𝑲𝒔 = {𝒔, 𝒄, 𝒂𝒅𝒅𝒓, 𝒕𝒊𝒎𝒆𝒔𝒕𝒂𝒎𝒑, 𝒍𝒊𝒇𝒆𝒕𝒊𝒎𝒆, 𝑲 𝒄, 𝒔 }𝑲𝑺
▪ Since only Kerberos and the service share the private key Ks , the ticket is known to be
authentic .
▪ The ticket contains a new private session key, K c,s , known to the client as well ; this key
may be used to encrypt transactions during the session
Cybersecurity Management 13
Kerberos authentication process
❑To guard against replay attacks, all tickets presented are accompanied by an
authenticator
{𝑨𝒄}𝑲 𝒄, 𝒔 = {𝒄, 𝒂𝒅𝒅𝒓, 𝒕𝒊𝒎𝒆𝒔𝒕𝒂𝒎𝒑}𝑲𝒄, 𝒔
❑if the time does not match the current time within the (predetermined) clock skew
limits, the request is assumed to be fraudulent
Cybersecurity Management 14
Kerberos authentication process
❑TGT request
Cybersecurity Management 15
Kerberos authentication process
❑Ticket request
Cybersecurity Management 16
Kerberos authentication process
❑Ticket use
Cybersecurity Management 17
Kerberos authentication process
Cybersecurity Management 18
Passwords
❑In spite of all the options, far and away the most common method for authentication is
the username/password combination
❑The system then authenticates your identity by verifying that the entered password is
valid for your account.
▪ You’ll be able to proceed only if the password you enter matches the password stored for
you in the system.
❑Protecting passwords
▪ Making passwords hard to guess
▪ Making passwords hard - hiding the file in which the passwords are stored, and in some
cases, performing a one-way encryption called a message digest, or hash which stores the
passwords in an encrypted form
Cybersecurity Management 19
Protection of passwords
❑Encryption
▪ Most systems encrypt the data stored in the system’s password file.
❑Access controls
❑Password attacks
❑Trying to guess a password by trying every possible combination of characters (brute
force attack)
▪ the longer the password, the longer it takes to try every combination
❑Dictionary attack
▪ With the help of online dictionaries of common passwords (English words, names of
people, animals, cars, fictional characters, places, and so on), crackers are quite likely to
be able to guess a good many of the passwords most people are likely to choose.
Cybersecurity Management 20
Authorization
❑Once you’ve been authenticated, the system uses your ID (and the security
information associated with it) to determine what you’re allowed to do in the computer
or on the network.
❑The process of determining the access bounds is called authorization
❑There are at least three basic types of access controls that provide different levels of
protection to the files in a system:
▪ Discretionary access control (DAC)
▪ Mandatory access control (MAC)
▪ Role-based access control (RBAC)
Cybersecurity Management 21
Discretionary access control
❑Discretionary access control is an access policy that restricts access to files (and other
system objects such as directories and devices) based on the identity of users and/or
the groups to which they belong
❑Three basic types of access:
▪ Read
o If you have read access for a file, you can read the file.
▪ Write
o If you have write access for a file, you can write (change or replace) the file.
▪ Execute
o The execute permission is relevant only if the file is a program. If you have execute
permission for a file, you can run the program.
Cybersecurity Management 22
Discretionary access control
❑discretionary access control methods
▪ Ownership
o E.g., If you’re the owner of the file, the system lets you read and change the file. If you’re not
the owner, you have no rights to the file.
▪ Self/group/public controls
o divides the world of users into three categories and tells the system what the users in each
category can do to a file
▪ File permissions
o Each file has a set of bits called file permissions associated with it.
Cybersecurity Management 23
Mandatory access control (MAC)
❑Mandatory access control is an access policy supported for systems that process especially
sensitive data
❑Systems providing mandatory access controls must assign sensitivity labels to all subjects
(e.g., users, programs) and all objects (e.g., files, directories, devices, windows, sockets) in the
system
❑all access decisions are made by the system.
▪ Unlike DAC, which allows users to specify, at their own discretion, who can and cannot share their
files
❑The decision to allow or deny access to an object (e.g., a file) involves an interaction between
▪ The label of the subject—for example, your clearance:
o TOP SECRET [VENUS TANK ALPHA]
▪ The label of the object—for example, a file named LOGISTIC with a sensitivity label:
o SECRET [VENUS ALPHA]
▪ An access request—for example, your attempt to read the LOGISTIC file.
Cybersecurity Management 24
Role-based access control (RBAC)
❑Permissions are associated with roles, and users are assigned to appropriate roles
▪ Roles are created for the various job functions in an organization and users are assigned
roles based on their responsibilities and qualifications.
▪ A role is properly viewed as a semantic construct around which access control policy is
formulated
❑simplifies management of permissions
Cybersecurity Management 25