Information AboutAccess Control |
| CATEGORIES ABOUT ACCESS CONTROL | |
| access control | |
| cisspaccess control | |
| cissp | |
| security | |
| network access | |
| computer security | |
| system administration | |
|
Access control is the ability to permit or deny the use of something by someone. PHYSICAL ACCESS Physical Access Of A Person may be allowed depending on payment, authorization, etc. Also there may be One-way Traffic Of People . These can be enforced by personnel such as a Border Guard , a Doorman , a Ticket checker, etc., or with a device such as a Turnstile . There may be Fence s to avoid circumventing this access control. An alternative of access control in the strict sense (physically controlling access itself) is a system of checking authorized presence, see e.g. Ticket Controller (transportation) . A variant is exit control, e.g. of a shop ( Checkout ) or a country. In Physical Security , the term access control refers to the practice of restricting entrance to a property, a building, or a room to Authorized persons. Physical access control can be achieved by a human (a guard, bouncer, or receptionist), through mechanical means such as locks and keys, or through technological means such as a card access system. COMPUTER SECURITY In Computer Security , access control includes Authentication , Authorization and Audit . It also includes measures such as physical devices, including biometric scans and metal Lock s, hidden paths, Digital Signature s, Encryption , social barriers, and monitoring by humans and automated systems. In any access control model, the entities that can perform actions in the system are called subjects, and the entities representing resources to which access may need to be controlled are called '''objects''' (see also , and arguably is responsible for the prevalence of Malware in such systems (see Computer Insecurity ). In some models, for example the Object-capability Model , any software entity can potentially act as both a subject and object. Access control models used by current systems tend to fall into one of two classes: those based on Capabilities and those based on Access Control Lists (ACLs). In a capability-based model, holding an unforgeable reference or ''capability'' to an object provides access to the object (roughly analogous to how possession of your house key grants you access to your house); access is conveyed to another party by transmitting such a capability over a secure channel. In an ACL-based model, a subject's access to an object depends on whether its identity is on a list associated with the object (roughly analogous to how a bouncer at a private party would check your ID to see if your name is on the guest list); access is conveyed by editing the list. (Different ACL systems have a variety of different conventions regarding who or what is responsible for editing the list and how it is edited.) Both capability-based and ACL-based models have mechanisms to allow access rights to be granted to all members of a ''group'' of subjects (often the group is itself modeled as a subject). Access control systems provide the essential services of ''identification and authentication'' (''I&A''), ''authorization'', and ''accountability'' where:
Identification and authentication (I&A) Identification and authentication (I&A) is a two-step process that determines who can log on to a system. Identification is how a user tells a system who he or she is (for example, by using a username). The identification component of an access control system is normally a relatively simple mechanism based on either Username or User ID. In the case of a system or process, identification is usually based on:
The only requirements for identification are that the identification:
Authentication is the process of verifying a user's claimed identity (for example, by comparing an entered password to the password stored on a system for a given username). Authentication is based on at least one of these four factors:
Authorization Authorization applies to subjects rather than to users (the association between a user and the subjects initially controlled by that user having been determined by I&A). Authorization determines what a subject can do on the system. Most modern operating systems define sets of permissions that are variations or extensions of three basic types of access:
These rights and permissions are implemented differently in systems based on ''discretionary access control'' (''DAC'') and ''mandatory access control'' (''MAC''). Accountability Accountability uses such system components as ''audit trails'' (records) and ''logs'' to associate a subject with its actions. The information recorded should be sufficient to map the subject to a controlling user. Audit trails and logs are important for
If no one is regularly reviewing your logs and they are not maintained in a secure and consistent manner, they may not be admissible as evidence. Many systems can generate automated reports based on certain predefined criteria or thresholds, known as ''clipping levels''. For example, a clipping level may be set to generate a report for the following:
These reports help a system administrator or security administrator to more easily identify possible break-in attempts. Access Control Techniques Access control techniques are sometimes categorized as either discretionary or mandatory. Discretionary Access Control Discretionary Access Control (DAC) is an access policy determined by the owner of an object. The owner decides who is allowed access to the object and what privileges they have. Two important concepts in DAC are
Access controls may be discretionary in ACL-based , Capability-based , or Role-based access control systems. (In capability-based systems, there is usually no explicit concept of 'owner', but the creator of an object has a similar degree of control over its access policy.) Mandatory Access Control Mandatory Access Control (MAC) is an access policy determined by the system, not the owner. MAC is used in multilevel systems that process highly sensitive data, such as classified government and military information. A multilevel system is a single computer system that handles multiple classification levels between subjects and objects.
Two methods are commonly used for applying mandatory access control:
Few systems implement MAC. XTS-400 is an example of one that does. TELECOMMUNICATION In Telecommunication , the term access control is defined in U.S. Federal Standard 1037C {Link without Title} with the following meanings: # A Service Feature or technique used to permit or deny use of the components of a communication System . # A technique used to define or restrict the rights of individuals or application programs to obtain Data from, or place data onto, a Storage device. # The definition or restriction of the rights of individuals or application programs to obtain data from, or place data into, a Storage Device . # The process of limiting Access to the resources of an AIS to authorized users, programs, processes, or other systems. # That function performed by the resource controller that allocates system resources to satisfy User requests. Notice that this definition depends on several other technical terms from Federal Standard 1037C. PUBLIC POLICY In Public Policy , access control to restrict access to systems (" Authorization ") or to track or monitor behavior within systems (" Accountability ") is an implementation feature of using Trusted Systems for Security or Social Control . SEE ALSO
REFERENCES
EXTERNAL LINKS
|
|
|