Access Controls - CompTIA Security+ SY0-701 - 4.6

Summary

The video script delves into the concept of access control in network security, emphasizing the importance of enforcing policies to regulate data access. It introduces various models, including mandatory, discretionary, role-based, rule-based, and attribute-based access controls, each catering to different organizational needs. The script also highlights the least privilege principle to minimize potential damage from malicious software and discusses time-based restrictions as an additional layer of security.

Takeaways

• 🔒 Access control is the process of enforcing policies that determine who can access certain data, which can be tailored to individuals or groups.
• 🛡️ Least privilege is a security best practice where users are given only the rights and permissions necessary to perform their job, reducing potential damage from malicious software.
• 🏷️ Mandatory access control uses labels to categorize resources and defines the rights and permissions users have based on these labels, with administrators controlling access.
• 📊 Discretionary access control allows the creator of the data to decide who can access it and under what conditions, providing flexibility but potentially less security.
• 🎯 Role-based access control assigns permissions based on job function, with administrators creating groups and assigning rights to those groups, simplifying permission management.
• 📜 Rule-based access control involves system-enforced rules set by administrators, where users have no control over permissions or rule creation.
• 🌐 Attribute-based access control is a modern approach that considers multiple criteria such as IP address, time of day, and user relationship to data for authorization.
• ⏰ Time of day restrictions can be applied across various access control models to limit access to data or resources based on specific hours.
• 🌐 Time zone considerations are important for worldwide organizations to ensure time of day restrictions are appropriately applied to all users.
• 📚 The script covers a range of access control models, each with its own strengths and applications, allowing organizations to choose the best fit for their needs.
• 🛠️ Administrators play a crucial role in configuring access controls, whether by defining labels, creating groups, setting rules, or combining attributes for fine-grained access management.

Q & A

What is the purpose of access control in a network system?

Access control is a process that enforces policies to allow or disallow users access to data, ensuring they have the necessary resources to perform their job functions.

How does the least privilege principle relate to access control?

The least privilege principle assigns rights and permissions to a user that only gives them exactly what they need to perform their job, without additional rights, to minimize potential damage in case of malicious software execution.

What is mandatory access control and how does it work?

Mandatory access control assigns labels to each resource, such as confidential or top secret, and defines the rights and permissions a user might have based on these labels, typically determined by the system administrator.

How does discretionary access control differ from mandatory access control?

In discretionary access control, the user who creates the data has control over who can access it and sets the permissions, unlike mandatory access control where the system administrator defines access based on labels.

Can you explain the concept of role-based access control?

Role-based access control assigns rights and permissions based on a user's job function. The system administrator creates groups for different roles and assigns permissions to these groups, which are then inherited by the users added to the groups.

What is rule-based access control and how does it function?

Rule-based access control involves a system of rules created by the system administrator that dictate rights and permissions. Users do not control these rules; instead, access to specific objects is determined by whether the rules apply to them.

How does attribute-based access control differ from other access control models?

Attribute-based access control uses multiple criteria such as IP address, time of day, and user relationship to data to determine access rights, allowing for more complex and fine-grained access control rules.

What is a time of day restriction in the context of access control?

A time of day restriction is a type of access control that allows or disallows access to certain data or resources based on the time of day, which can be further refined by considering the user's time zone.

Why might an administrator implement time of day restrictions?

Administrators might implement time of day restrictions to control access during off-hours to sensitive resources or to manage resource availability during peak times, enhancing security and efficiency.

What is the significance of the administrator's role in configuring access control?

The administrator plays a crucial role in configuring access control by defining policies, creating groups, setting permissions, and establishing rules that govern user access to data and resources within the system.

How can access control models be adapted to suit different organizational needs?

Different organizations can choose the access control model that best fits their security requirements and operational structure, whether it be mandatory, discretionary, role-based, rule-based, or attribute-based access control.

Outlines

00:00

🔒 Access Control and Security Best Practices

This paragraph introduces the concept of access control in network security, emphasizing the importance of enforcing policies that regulate data access. It discusses individual and group-based access, the policy-making process, and the IT team's role in implementing these policies. The paragraph also highlights the least privilege principle, which involves assigning users only the permissions they need to perform their job, thereby limiting potential damage if malicious software is run. Mandatory access control is mentioned as a highly secure method that uses labels to define access rights, with administrators defining these rights. Discretionary access control is also covered, where data creators control access to their data, offering flexibility but potentially reducing security.

05:03

📜 Types of Access Control Models

The second paragraph delves into various access control models, starting with role-based access control, which assigns permissions based on job functions and is implemented through group management by system administrators. This model simplifies the assignment of permissions by adding users to groups with predefined rights. The paragraph also touches on rule-based access control, where system administrators create and enforce rules that determine access to specific objects, and attribute-based access control, which uses multiple criteria to decide access rights. Time of day restrictions are presented as a common additional control that can be applied across models, with considerations for time zones in global organizations. Examples of time restrictions for different resources are provided to illustrate practical applications.

Keywords

💡Access Control

Access control is a security technique that regulates who or what can view or use resources in a computing environment. In the video's context, it is the process of enforcing policies to allow or disallow access to data, which is essential for ensuring that individuals have the necessary permissions to perform their jobs without compromising security. The script mentions various models of access control, emphasizing the importance of tailoring the control model to the organization's needs.

💡Least Privilege

Least privilege is a security principle that dictates that a user should be given the minimum levels of access necessary to perform their job. The script explains that by adhering to this principle, the potential damage caused by malicious software is limited, as it would only have the permissions of the user it infects. This concept is foundational to the video's discussion on best practices in access control.

💡Mandatory Access Control

Mandatory access control (MAC) is a model where the system administrator assigns labels to resources and defines the rights and permissions associated with each label. The script uses the example of labeling files with security levels like 'confidential' or 'top secret' and then assigning users access based on these labels, ensuring a high level of security by centralizing control over resource access.

💡Discretionary Access Control

Discretionary access control (DAC) allows the owner of a resource to decide who can access it and under what conditions. The video script illustrates this with the example of a user-created spreadsheet, where the creator can grant others read or write permissions. This model provides flexibility but also poses security risks, as it relies on individual users to manage security controls properly.

💡Role-Based Access Control

Role-based access control (RBAC) assigns permissions based on a user's job function within an organization. The script describes how administrators create groups with specific permissions, such as a 'manager group' or a 'project manager group', and then add users to these groups to grant them the associated rights. This model centralizes the management of permissions and is more secure than DAC.

💡Rule-Based Access Control

Rule-based access control is a model where access to resources is determined by a set of rules defined by the system administrator. The script explains that these rules can be very specific, such as allowing access to certain data only during business hours or only when using a specific browser. This model provides a high degree of control and customization for administrators.

💡Attribute-Based Access Control

Attribute-based access control (ABAC) uses multiple criteria to determine access to resources. The script refers to it as a next-generation authorization model that can evaluate various attributes, such as the IP address of the requester, the time of day, or the relationship to the data. ABAC allows for complex and fine-grained access control policies, enhancing security by considering a wide range of factors.

💡Time of Day Restriction

A time of day restriction is a type of access control that limits access to resources based on the time. The script provides examples such as restricting access to a training room network during non-working hours or limiting access to R&D databases to regular business hours. This restriction can be combined with time zone considerations for global organizations, adding an additional layer of control.

💡Administrator

In the context of the video, an administrator is responsible for defining and enforcing access control policies. They create groups, assign permissions, and set rules that govern access to resources. The script emphasizes the role of the administrator in various access control models, highlighting their importance in maintaining security and ensuring that users have appropriate access.

💡Permissions

Permissions in the video script refer to the specific rights granted to users or groups within an access control system. These can include the ability to read, write, modify, or execute actions on resources. The script discusses how permissions are assigned in various access control models, such as DAC, RBAC, and ABAC, and how they are crucial for determining the level of access a user has.

💡Resource

A resource in the video script is any piece of data or system component that requires access control, such as files, folders, or software applications. The script discusses how different access control models manage access to these resources, ensuring that only authorized users can view or interact with them according to the defined policies.

Highlights

Access control is essential for providing authenticated users with the necessary resources to perform their job functions.

Access control models enforce policies that determine who can access data, and they can be tailored to individual or group needs.

The least privilege principle minimizes the rights and permissions assigned to users, enhancing security by limiting potential damage from malicious software.

Mandatory access control labels resources with security levels like confidential, secret, or top secret, defining user access based on these labels.

In discretionary access control, data creators control access to their data, setting permissions for others to read or modify.

Role-based access control assigns permissions based on job functions, centralizing the management of user access rights.

Administrators create groups with specific permissions in role-based access control, simplifying the assignment of rights to users.

Rule-based access control involves system-enforced rules set by administrators, without user control over permissions or rules.

Attribute-based access control uses multiple criteria to determine access, offering a sophisticated and flexible authorization model.

Time of day restrictions can be applied across various access control models to limit access to data or resources based on the time.

Administrators must consider time zones in worldwide organizations when implementing time of day restrictions.

Access control policies are crucial for defining what resources a user may need and translating these policies into system processes.

Different organizations can choose the access control model that best suits their needs from the broad range of available options.

Mandatory access control is characterized by the administrator's role in defining user rights and permissions based on resource labels.

Discretionary access control provides data owners with the flexibility to control who accesses their data and under what conditions.

Role-based access control streamlines the process of assigning permissions by grouping users with similar job functions.

Rule-based access control allows for the creation of specific rules that govern user access to objects based on various conditions.

Attribute-based access control is a modern approach that evaluates multiple attributes to determine data access, enhancing security and precision.

Transcripts

Once someone authenticates to a network,

we still need to provide them with access

to the resources they need to be able to perform their job

function.

We refer to this as access control,

and it's a process of enforcing the policies that

would allow or disallow someone access to data.

This access control can be associated with an individual

or a group of individuals.

There's usually a process that defines the policy of what

someone may need access to, and then the IT team

needs to take that policy and change it

into the process required by the operating system to allow

or disallow rights to data.

There are very broad access control models,

and we'll look at those models in this video.

There are slight differences between these different types

of access controls, and different organizations

can choose the access control that's best for them.

We'll first start with a security

best practice that can be applied across any

of these access controls, and that best practice

is least privilege.

Least privilege means that we will

assign rights and permissions to a user that

gives them exactly what they need to perform their job.

We don't give them additional rights and permissions,

and we certainly wouldn't provide them

with administrator access.

This means, by default, every user

will have limited privileges to the operating system.

If a user does happen to run malicious software,

that software would only have the rights and permissions

associated with that user and would hopefully

limit the scope of any damage.

If you're working in a highly secure area,

you may be working with an access control called

a mandatory access control.

Mandatory access control assigns a label to each resource

that someone may need access to.

So a particular file or folder may

be tagged as confidential, secret, top secret,

or a number of other types of mandatory access control

labels.

One important aspect of a mandatory access control

is that the administrator of the system

is the one that defines what type of rights and permissions

a user might have.

So a user in the shipping and receiving department

may have access to confidential data.

But someone who's higher up in the management chain

might have access to top secret data.

One very common type of access control

is a discretionary access control.

With a discretionary control model,

the user that creates the data has the control

on who can access the data and how they

can access that information.

For example, if you create a spreadsheet,

you get to decide who else has access to that spreadsheet.

And you can also set different permissions

to the users who may have access,

where some people can modify the spreadsheet

and others might only be read-only.

This allows the owner of the data

to have complete control on who can access that information.

This access control gives the owner of the data

great deal of flexibility when determining

who has access to that data.

Unfortunately, this also means that this level of access

is also less secure because you're

relying on each individual user to set the appropriate security

controls for every piece of data they create.

A more centralized control model would be a role-based access

control.

This access control is based on your job function.

So if you are a manager, you have a certain type of rights

and permissions to data.

If you're a director, you have a different set

of rights and permissions.

And if you're a team lead or project manager,

there are different sets of permissions for those roles

as well.

This starts with the administrator

of the system creating a number of different groups.

There might be a manager group, a director group, a team lead

group, and a project manager group.

They would then assign rights and permissions

to the group itself, knowing that managers

have a certain type of rights and permissions,

director have a completely different set, and so on.

Once this group is created by the administrator

and rights are assigned to the group,

the administrator will add users to that group.

Each user added to the group receives

the rights and permissions associated with that group.

So we don't have to assign specific permissions directly

to a user.

We can simply add that user to the group,

and they receive all of those permissions implicitly.

In Windows, this is referred to as groups,

and you can associate a role-based access control

to each group.

For example, you might have a group

for shipping and receiving, and you

can associate rights and permissions

to the shipping software for anyone

who might be in that group.

You might also have a group for managers

of shipping and receiving, and managers

might have additional access that allows

them to view the shipping logs.

Some access control methods have a list of rules,

and those rules are associated with rights and permissions.

We refer to this as a rule-based access control

because there are a number of system-enforced rules

that are created by the system administrator.

This means the user does not control

any of the rights and permissions

or create any of the rules.

The administrator is responsible for configuring and assigning

all of those permissions.

With a rule-based access control,

we would first create a rule, and then we

would associate that rule with a specific object.

Each user that accesses that object

is then checked in the rule base to see if any of those rules

might apply to that individual.

For example, there might be a user

that needs to access data that's located in a lab.

But there is a rule associated with that data that

says you can only gain access if the time is between 9:00 AM

and 5:00 PM.

And if somebody tries to access the data that's

outside of that schedule, that rule would not allow access.

Or the rule might be that a form on a web page

can only be filled out by someone using the Chrome

browser.

This rule-based access control allows an administrator

to set any type of criteria and associate that criteria

with a specific object.

A more modern style of access control

is the attribute-based access control.

With an attribute-based access control,

there are many different criteria

that you can use to determine whether someone would

have access to data or not.

This allows administrators to create very complex rule

sets that determine whether certain types of data

are accessible or not.

You can think of this as a next generation of an authorization

model.

So a type of access control that takes into account

a number of different criteria may

be evaluating the IP address of the person making

the request, the time of day, the desired

action, whether they're writing or reading information,

and what relationship they might have to the data.

The administrator can combine many different criteria

together to determine exactly what type of control someone

might have over any object.

One type of restriction that can be applied across many

of these different control models

is a time of day restriction.

This means an administrator can allow or disallow access

to a certain type of data or resource object

based on what time of the day it happens to be.

This may not be the only access control method,

but it does provide the administrator with options when

configuring access to data.

Of course, when you're working with the time of day

or the day of the week, this can become very complicated

if you are a worldwide organization.

So an administrator might include

not just the time of day restriction

but what time zone is native for that particular user.

So a good example of some time of day restrictions

might be that a training room network

is inaccessible between the hours of midnight and 6:00 AM.

Or it may be that conference room access

is limited after 8:00 PM.

And if you want to access certain types of data,

the R&D databases are only available between the hours

of 8:00 AM and 6:00 PM.