Chapter 9: Access Control

Chapter 9: Access Control

2

Objectives

Apply the concepts of default deny, need-to-know, and least privilege

Secure user accounts throughout the employee lifecycle

Understand secure authentication

3

Objectives Cont.

Protect systems from risks associated with remote access and telecommuting environments

Monitor and log all access-related activities and events

Develop policies to support access control to information assets

4

What Is a Security Posture?

It is the organizational attitude toward security that is reflected in its default position

Two fundamental security postures: Secure, which implements the “default deny” model Reactive, which implements the “default permit” model

Every access control decision for a company is based on that company’s security posture

5

What Is a Security Posture? Cont.

Default permit vs. default deny Default permit: by default, out of the box, no

security is deployed, everyone can do everything. Easier to deploy, works out of the box No security

Default deny A.k.a. “deny all” Access is unavailable by default until the appropriate

control is altered to allow access

6


Principle of Least Privilege Definition: the least amount of permissions granted a user

that still allows them to perform whatever business tasks they have been assigned, and no more

This is a strong foundation for any access control policy Protects the data but also protects the user. They can’t be

accused of having deleted a file to which they can’t gain access!

From a cultural stand point, it is important to explain to employees why they are not “trusted” with all the company’s data

7


Need-to-know Definition: having a demonstrated and authorized

reason for being granted access to information Should be made a part of the company’s culture Should be incorporated in security training

curriculum At the very least protects the confidentiality of

corporate data, but may also protect integrity and availability depending on the attack type

8


Three main access control models MAC (Mandatory Access Control): data is

classified, and employees are granted access according to the sensitivity of information

DAC (Discretionary Access Control): Data owners decide who should have access to what information

RBAC (Role-based Access Control): Access is based on positions (roles) within an organization

Companies need to decide which access control model they will implement

9


Classification models Used in public sector:

Top secret, secret, confidential Used in the private sector:

Sensitive, confidential, public Classification level combined with need-to-

know should define actual access level

10


The role of the information owner The information owner is the one who defines the

access rules pertinent to the information for which they are responsible

They may enlist the assistance of the Information Security Officer

11

Managing User Access

Simple yet important questions that should be asked – and answered! – when managing user access: Who creates the user accounts? How are they created? How will this function be logged? What happens when user situations evolve? How to insure that each user’s account is unique?

12

Managing User Access Cont.

User Account Creation Transcends departmental boundaries Requires involvement & communication between:

Human Resources Information Technology Information Security Officer

13


User Access Management Account creation needs to be regulated with an

official, approved process HR should initiate the initial paperwork to require

creation of a new account The request form should include:

Demographic information Employee role Access & equipment requirements

14


User Access Management Filled HR form should be sent to appropriate

supervisor / manager for authorization ISO may also be consulted, especially if level of

access for this user account is high Once authorized, form is sent to the department

responsible for user account creation (usually IT) Account should not be created, and privileges

should not be assigned, until full authorization has been granted

15


User Access Management Inside the department in charge of account

creation, there should be a position responsible for all user account-related functions, such as creation, modification, deletion.

All user account tasks should be logged and auditable for accountability purposes

All logging should be automated A separate person/department should be in

charge of reviewing this log

16


Changes to the user status The accounts and the level of access they are

granted are a reflection of an employee’s status within the company Promotions may imply new responsibilities and/or tasks,

and therefore more/different privileges to be assigned to the account

If the career move is in a different department, the account should be audited to make sure that privileges that applied to the previous position are still needed for the new one. If not, they should be revoked

17


Changes to the user status The accounts and the level of access they are

granted are a reflection of an employee’s status within the company In the case of employee termination, HR must

communicate with the proper department in charge of user account management so that the account is at the very least disabled, if not deleted

A lack of communication in this sort of situation can result in a user account still being valid while the employee to whom it was assigned is not in the employ of the company anymore!

18

With Privilege Comes Responsibility The privilege / responsibility correlation

Certain positions in a company require for the employee to have a high level of privilege in order for them to execute the tasks inherent to their job

Accounts with high level of privilege should be monitored and audited

Such employees should be provided two accounts: one with the high privilege level, and another, “regular” account for all non-high privilege tasks such as email and web surfing

19

Keeping Passwords Secure

Password Management Single factor authentication means using only one

way to verify a users identity. This is generally a password

Users should be required to keep their passwords confidential

Passwords should be changed whenever there is a chance they were compromised

Compromising a password may result in unauthorized access as well as identity theft

20

User Authentication for Remote Connections Remote Access

Users who have a demonstrated business-need to access the corporate network remotely and are authorized to do so must be given that privilege

Not all employees should be given this privilege by default

Remote access activities should be monitored and audited

The organization’s business continuity plan must account for the telecommuting environment

21

Monitoring System Access and Use

Auditing should be turned on, and logs generated should be reviewed daily

The policy should define: What will be logged Who will be in charge of reviewing those logged What the log review schedule will be

22

Monitoring System Access and Use Cont. What activity should be monitored?

Four main monitoring areas: Authorized access Privileged operations Unauthorized attempts System alerts or failures

23


Authorized access: Log when users and systems that have proper

authorization connect and use information resources Information gathered should include

ID of the user or system performing the authorized action Date and time of each important event What kind of event it was Which program/utility was used

24


Authorized access : Many event kinds associated with authorized access:

Account logon events Account management events Directory service events Logon events Object access events Policy change events Privilege use events Process tracking events System events

25


Authorized access: For all events recorded, the administrator has to decide

which of the following will be logged: Success of the event Failure of the event Both

The more information logged, the larger the log grows, which often leads to the logs becoming unmanageable and ignored – therefore not reviewed

26


Privileged operations: Events for activities/operations reserved for those users

with special privilege to perform critical operations The use of the administrator account (or root,

supervisor) must be closely monitored Other critical events to be monitored include:

Startup / shutdown Attachment of devices Hardware installation Software installation

27


Unauthorized attempts include: Failed attempts at access Access policy violations Also includes events collected from firewall logs

Dropped incoming connections Disallowed outgoing connections

28


System Alerts or Failures generated by: Hardware failures Application failures Power problems

29

Monitoring System Access and Use Cont. Log Review and retention

How often should the logs be reviewed? By whom?

By an authorized employee who does not have full admin rights on the network for separation of duties purposes

How long will the log files be archived for? How will they be stored securely?

30

Is Monitoring Legal?

Courts have favored an employer’s right to protect their interests over individual privacy rights because: Actions were taken at the employer’s place of work Equipment used – including bandwidth – was company-

provided Monitoring the work also helps ensure the quality of

work The employer has the right to protect property from theft

and/or fraud

31

Is Monitoring Legal? Cont.

Courts indicate that monitoring is acceptable if it is reasonable: Justifiable if serving a business purpose Policies are set forth to define what privacy employees should

expect while on company premises Employees are made aware of what monitoring means are

deployed Acceptable use agreement should include a clause

informing users that the company will and does monitor system activity

Users must agree to company policies when logging on

32

Summary

Access control is a complex domain. Access to information is extremely important to regulate.

User access and user actions on the network must be monitored and logged, whether they be located on premises or gaining access to the network remotely.

Monitoring is useless if the information gathered is not reviewed regularly.

Documents

Chapter 9: Access Control