Last Week: Main Questions

• Who you are (IAM); What you can do (AC); How you access resources securely across systems (OAuth)?
  

What is Access Control?

• It's the process of determining and enforcing who can access what resources in a system.

  • Access Control the ability to control whether a subject (such as an individual or a process running on a computer system) can interact with an object (such as a file or hardware device)

• Importance: Protects sensitive information, prevents unauthorised access, and ensures compliance with regulations.

• But, does it confused with Authentication?

Authentication vs. Access Control: Not the Same!

Authentication deals with verifying the identity of a subject.

• Authentication: Think of it as logging into your computer with a username and password.

  • The system (authentication) checks your credentials to ensure you are who you say you are. Just like showing your ID to prove your identity.

• Access Control: Now, once you're in, what can you do?

  • AC determines what you can access on the computer or network.
    • Just because you logged in doesn't mean you can access all files and applications.

AC Principles

• Cybersecuity: CIA - Confidentiality, Integrity, Availability

The four parts of access control are:

• Identification - Who: is asking to access the asset?

• Authentication - Can: the requestor’s identity be verified?

• Authorisation - What :exactly, can the requestor access? And what can they do?

• Accountability - How can actions be traced to an individual?

  • Associating actions with users for later reporting and research is known as accountability.

AC Principles

These four parts are divided into two phases:

• The policy definition: This phase determines who has access and what systems or resources they can use. The authorisation definition process operates in this phase.

• The policy enforcement: grants or rejects requests for access based on the authorisations defined in the first phase. The identification, authentication,
  authorisation execution, and accountability processes operate in this phase.

Example: Linux Permissions

Access Control Models

1. Discretionary Access Control (DAC)

2. Mandatory Access Control (MAC)

3. Rule-Based Access Control (RuBAC)

4. Role-Based Access Control (RBAC)

5. Access Control Lists(ACL)

6. Attribute-Based Access Control (ABAC)

1. Discretionary Access Control (DAC)

Access is determined by the resource owner.
How it works

• The owner decides who can read, write, or execute a resource.
• Common in operating systems such as Linux and Windows.
• Simple and flexible, but users can accidentally or intentionally share access.

E.g.
User A owns a file and allows User B to read it but denied user C to do so.

DAC: Pros and Cons

Pros

• Simple to manage
• Flexible for users
• Widely supported in operating systems

Cons

• Higher risk of unauthorised sharing
• Limited central control
• Less suitable for high security environments

Example in practice

• File permissions in Unix/Linux (chmod, chown)

2. Mandatory Access Control (MAC)

Access rights are regulated by a central authority based on multiple levels of security.

• Mechanism: Users and resources are assigned security labels. Access is granted based on these labels and policies.

• SysAdmin is no longer the boss:

• Characteristics: High security: Strict and non-discretionary control.

• Complexity: Requires careful planning and management.

• Occasionally synonymous with MLS - Multi-Level Security (Unclassified, Confidential, Secret, Top Secret)

MAC Cont'

• Scenario: Emily has a "Secret" clearance and can access "Secret" documents, but not "Top Secret" ones.

• Example: Military systems with classified information, e.g. Bell LaPadula

  • Users need the appropriate clearance level to access certain documents.
  • System and owner collaboration determines access.
  • Bell-LaPadula model compares subject and object labels to grant/deny access

Activity

In pairs so a quick bit of research on Mandatory Access Control (MAC) to answers in small groups or post them online.

1. Where is MAC used in the real world? Give one example.
2. Why might an organisation choose MAC instead of other access models?
3. What could be a downside of using MAC?

3. Rule-Based Access Control (RuBAC)

• Access is based on a set of pre-defined rules or policies, rather than roles or individual user attributes.

• Provides fine-grained access control by enforcing rules that specify conditions under which access is granted or denied.

• Data owners make or allow the rule.

RuBAC:Key Features

• Rules and Policies: Access decisions are made based on a comprehensive set of rules.
• Conditions: Rules can include conditions such as time of day, IP address, and user attributes (PAM in Linux).
• Automation: Automatically enforces policies without manual intervention.

System Example: PAM (Pluggable Authentication Modules)

• It allows system administrators to define and manage how different applications or services authenticate users without needing to modify the applications themselves.
• By using different methods (like passwords, fingerprints, or two-factor authentication)

Activity: In pairs

• Find one real example where rule-based access is used?
• What kind of rules could a system use to allow or block access?
• What are the benefits and challenges of using rules instead of roles?

4. Role-Based Access Control (RBAC)

• It bases access control approvals on the jobs the user is assigned
• Simplifies administration and enhances security by grouping permissions by role rather than assigning them individually.

RBAC: Example

• Role Engineering: Before you can assign access rules to a role, you must define and describe the roles in your organisation.
• Risks: Overgeneralising.
  • Which leads to "a need-to-know violation"

5. Access Control Lists(ACL)

• A set of rules that defines what actions (e.g., read, write, execute) specific users or groups can perform on system objects (like files or network devices).

• Used in operating systems (like Linux) and network devices (such as routers and firewalls) to enforce access permissions.

Key Features of ACLs:

1. Granular Control: Allows specific access permissions for individual users or groups.
2. Flexibility: Multiple rules can be applied to the same resource, allowing for fine-tuned access management.
3. Application: Common in both file system permissions (e.g., Unix/Linux) and network security.

• E.g.:

  • setfacl -m u:username:rwx /path/to/file

    • This command grants a user read, write, and execute permissions on a file

  • permit tcp any any eq 80 : Allows HTTP traffic on port 80

6. Attribute Based Access Control (ABAC)

ABAC decides access by checking attributes against policies. e.g.:

• User (role, clearance, department)
• Resource (file type, owner, sensitivity)
• Environment (time, location, device)
• Action (read, write, delete)

Access is granted or denied based on attribute evaluation (Decision Making), offering flexible and fine grained control without hard coded rules.

ABAC: Simple Scenario

Effects of Breaches in Access Control

Failure to implement robust access control

• Disclosure of sensitive information and data integrity corruption
• Loss of intelligence and system and process failure
• Short-term and long-term attacks
  

Centralised and Decentralised Access Control

1. Centralised Access Control

One central authority manages and enforces access decisions.

• Single point of control
• Uniform policy enforcement
• Easier to update and monitor
• Scales well for large environments

1. Centralised Access Control

Pros

• Consistent security
• Simple administration
• Central monitoring and auditing

Cons

• Single point of failure
• Can become a performance bottleneck

2. Decentralised Access Control

Access control decisions are managed locally by teams or system owners.

• Local authority (for example department managers)
• No single point of failure
• More autonomy and flexibility

Pros

• Faster decisions locally
• Reduced dependency on one system
  Cons
• Less standardisation
• Harder to maintain consistent policies

PAM: Pluggable Authentication Modules

• It is a flexible system used to manage authentication for applications and services.

• Provides a way to centralise and standardisa authentication methods, allowing the system to enforce authentication policies across different services.

• Why PAM is important

  • Modular Design: Different authentication modules (e.g., password, token, biometrics) can be easily added or removed.
  • Service-Specific Control: PAM configurations allow different services (e.g., SSH, sudo) to have their own tailored authentication rules.
  • Security: Enforces consistent security policies and simplifies multi-factor authentication setup (MFA).

PAM

How to Read a PAM Rule

A PAM rule = Type + Flag + Module + Options

Control Flags

Determines how PAM processes multiple modules. Flags include:

Location and Example of PAM Configuration:

• Located in /etc/pam.d/

• Each service has a configuration file (e.g., login, sshd).

  1. auth required pam_unix.so
  2. auth sufficient pam_google_authenticator.so
  

Further reading about PAM:

• IBM-PAM
• RedHat-PAM

Lab

• Access Control and PAM Lab: