Chapter IV
Introduction to Access Control
Mechanisms
Access control mechanisms are essential in modern computer systems
to prevent unauthorized access to sensitive resources. This chapter will
discuss three key access control models and their implementations.
Understanding Access Control
Models
Access Control Models
• DAC (Discretionary Access Control)
• MAC (Mandatory Access Control)
• RBAC (Role-Based Access Control)
DAC (Discretionary Access
Control)
A model where access is granted based on the owner's discretion.
Ex.
File System Example
A user, John, owns a file on a Windows system.
He grants read permission to his friend, Alice, but denies write
permission.
Alice can view the file but cannot modify it.
MAC (Mandatory Access
Control)
A model where access is granted based on a system's security policy.
Ex.
• A military network uses MAC to restrict access to classified
information.
• Users are assigned a classification label (e.g., TOP SECRET) based on
their clearance.
• Access is granted or denied based on the classification label, not the
user's identity.
RBAC (Role-Based Access
Control)
A model where access is granted based on a user's role within an
organization.
Ex.
Company IT Department Example
A company uses RBAC to grant access to IT systems.
• Employees are assigned roles (e.g., Administrator, Help Desk, User).
• Users are granted access based on their role, not their identity.
Implementing Access Control
Hardware-based access control (e.g., biometrics, smart cards)
• Increased security through unique identification.
• Reduced risk of unauthorized access.
• Convenience for users.
Software-based access control (e.g., access control lists, encryption)
ACLs are protocols used to define who or what is allowed to access
resources in a computing environment. They specify which users or
systems have permission to interact with system resources, such as files
and directories.
• Fine-grained control over resource access.
• Flexibility in permissions management.
• Enhanced security through encryption of sensitive data.
Users are granted access based on their role, not their identity.
user access is determined primarily by the role assigned to them rather
than their unique identity. Each role corresponds to a predefined set of
permissions.
• Reduced Complexity: Simplifies permission management because
privileges are assigned to roles rather than individuals.
• Improved Security: Ensures users have the minimum level of access
necessary to perform their job functions, helping to prevent
unauthorized access.
• Easier Compliance: Streamlines audits and compliance processes, as
roles can be clearly documented with associated permissions.
Auditing and Reviewing Access
Controls
Auditing Access Controls
Log analysis
Log analysis is the process of reviewing and interpreting log files
generated by systems, applications, and network devices to identify
trends, detect anomalies, and troubleshoot issues.
• Security Monitoring:
• Identifies unauthorized access attempts, security breaches, and unusual
behavior in real-time.
• Performance Optimization:
• Helps in diagnosing performance issues by analyzing error logs and system
performance metrics.
• Compliance and Auditing:
• Ensures adherence to regulatory requirements by maintaining logs for audit
trails.
• System Logs:
• Operating system logs (e.g., Windows Event Logs, Linux Syslogs)
• Track system events, errors, and performance issues.
• Application Logs:
• Logs generated by applications to record operations, errors, and user
activities.
• Useful for debugging and monitoring application performance.
• Network Logs:
• Firewall logs, intrusion detection system logs, etc.
• Monitor network traffic and detect potential intrusions.
• Manual Analysis:
• Reviewing logs line by line to identify patterns or irregularities (time-
consuming and error-prone).
• Automated Log Analysis:
• Using log management tools that analyze logs in real-time.
• Leverages pattern matching, heuristics, and machine learning algorithms.
Compliance reviews
Compliance reviews are systematic evaluations conducted to ensure
that an organization adheres to applicable laws, regulations, standards,
and internal policies.
• Risk Management:
• Identify and mitigate risks that could lead to non-compliance and associated
penalties.
• Maintain Regulatory Standards:
• Ensure that the organization meets legal and regulatory obligations to avoid
sanctions or reputational damage.
• Continuous Improvement:
• Facilitate ongoing enhancements to policies and practices, ensuring
alignment with best practices.
• General Data Protection Regulation (GDPR):
• Protects personal data and privacy for individuals within the European Union
and the European Economic Area.
• Health Insurance Portability and Accountability Act (HIPAA):
• Governs the privacy and security of health information in the United States.
• Sarbanes-Oxley Act (SOX):
• Enforces financial transparency and accuracy in public companies to protect
investors.
Payment Card Industry Data Security Standard (PCI DSS)
Sets requirements to ensure all companies that accept,
process, store, or transmit credit card information maintain a secure
environment.
• Planning:
• Define the scope, objectives, and methodology of the review.
• Identify relevant regulations and internal policies.
• Data Collection:
• Gather necessary documentation, including policies, procedures, financial
records, and communications.
• Conduct interviews with key personnel.
Evaluation:
• Assess compliance based on the collected data and predetermined criteria.
• Identify any gaps or non-compliance issues.
Reporting:
• Document findings in a comprehensive report that includes identified issues,
risks, recommendations, and an action plan.
Follow-Up:
• Monitor the implementation of recommended actions and ensure necessary
corrective measures are taken.
Regular Reviews:
• Schedule compliance reviews periodically (e.g., annually or biannually) to stay
ahead of regulatory changes.
Stakeholder Involvement:
• Involve key stakeholders and departments (legal, finance, IT) to gain diverse
perspectives and insights.
Training and Awareness:
• Provide training to employees on compliance obligations and ensure
awareness of policies and procedures.
Documentation:
• Maintain thorough documentation throughout the review process to support
findings and facilitate future audits.