When it comes to access to network resources, there are a number of ways to make sure that only certain people are able to perform certain tasks. In this section, we will discuss the principles behind identification, authorization, and access control. We will also look at some of the practical methods that can be implemented to ensure the identity of the users on a system. This section will cover the following topics:
- Identification versus authentication
- Authentication (single factor) and authorization
- Multifactor authentication
- Biometrics
- Tokens
- Smart card
- Common Access Card (CAC)
- Personal Identity Verification card (PIV)
- Least privilege
- Separation of duties
- Single sign-on (SSO)
- ACLs
- Access control
- Mandatory access control
- Discretionary access control
- Role/rule-based access control
- Implicit Deny
- Time-of-day restrictions
- Trusted OS
- Mandatory vacations
- Job rotation
Identification versus Authentication
Identification is the act of claiming an identity. A logon without a password is a good example of identification. A timecard punch machine is another good example of identification. These identification processes allow an identity to be claimed, but they do not have any mechanism to ensure that the identity claimed is in fact the identity of the claimant.
The process of ensuring that users can identify only as themselves is known as authentication. Authentication adds a verification step to the identification process. The stronger the authentication method chosen, the more confidence can be placed on the identity presented.
Authentication (Single Factor) and Authorization
Authentication usually falls under three basic types, known as authentication factors: something you know, such as a password; something you have, such as a key or a badge; and something you are, such as a fingerprint scan.
Single factor authentication relies on any single type of method to ensure the identity of a user. A password is something you know and is the most common type of single factor authentication. A username and a PIN would also be considered single factor authentication because they fall under the same category of something you know. Another example of an authentication factor is a locked door, which usually requires a key, something you have.
Any of these methods are sufficient to establish the identity and authorization of a user in certain circumstances. The greatest advantage of single factor authentication is that unauthenticated individuals are still denied access, while the authentication process remains relatively simple. The greatest disadvantage lies in the possibility of a single factor being compromised. A password can be inadvertently disclosed, a PIN can be shoulder-surfed, or a key can be lost or stolen.
There are ways to increase the confidence we have in the identity of an authenticating individual, but as we introduce more factors to the authentication process, we increase our confidence at the cost of some simplicity.
Multifactor Authentication
If, instead of just requiring a key (something you have) to open a door, we also require a combination, we can increase our confidence in the authenticating individual’s identity. The requirement of multiple types of authentication mechanisms is known as multifactor authentication. This increases the number of hurdles an attacker must clear to gain access. Now, if an employee loses a key or set of keys, the organization is no longer immediately open to unauthorized access.
One everyday example of multifactor authentication is an ATM card that requires a pin. To withdraw money from an account, the user has to present something they have, the ATM card, and something they know, the PIN. For situations where ensuring the identity of the user is crucial, multifactor authentication is a must.
Biometrics
Though most of our examples have focused on something you know or something you have, there is a third type of authentication: something you are. Using a person’s physical characteristics to authenticate his or her identity is known as biometrics. The convenience store clerk who checks to ensure the face in real life is a match to the face on the ID is engaging in biometric analysis. When an automated system examines a user’s fingerprint, or retina, or typing cadence, or voice, the system is engaging in biometric analysis.
Tokens
The “something you have” category can take many different forms. One method of increasing security is to grant authorized users access to a USB token, or dongle. This device may need to be connected to the computer at the time of login, or it may generate one-time use passwords or PINs that must authenticate to a central server. Using a USB token or token generator is one way to add “something you have” to the authentication process.
Smart Card
Another “something you have” method of authentication is a smart card. This functions similarly to the USB dongle that requires a connection to a computer. The smart card has a chip that must be scanned before access will be granted. The chip contains a certificate tied to a certain user account, and it may require a PIN. It may also act as a non-electronic form of identification, with electronic identity information available on the card.
Common Access Card (CAC)
One specific type of smart card is the Common Access Card (CAC) issued by the United States Department of Defense. A CAC can include photo identification, barcode-encoded information, and embedded PKI and authentication information.
Personal Identity Verification Card (PIV)
Another common smart card is the Personal Identity Verification (PIV) card. This card, granted to federal employees and contractors, contains the necessary data for the cardholder to be granted access to Federal facilities and information systems.
Least Privilege
A security principle that is vital in controlling access to network resources is the principle of least privilege. In any case where access is to be granted to shared resources, the goal is to grant as much access as is needed and as little access as possible. If a user does not need to be able to delete documents, but does need to read them, he or she should be granted only read access.
Separation of Duties
The separation of duties can ensure that no one user or employee is able to singlehandedly make large and possibly detrimental decisions. Just as it is very common to require review and authorization for an unusually large check to be written, it is a good idea to require input from more than one source before making serious infrastructure changes.
Single Sign-on (SSO)
Single sign-on is a concept that allows users to sign on only once to access a wide variety of different network resources. One example of SSO that we have already discussed is Kerberos. Some technical complexity exists in the design of SSO systems, but these systems can greatly contribute to a system’s ease of use from a user perspective. With single sign-on, a user can enter authentication information once and carry that authenticated state with him or her during an entire session.
ACLs
ACLs, or access control lists, are a basic networking tool to determine what traffic can or cannot flow across a network link. These ACLs can be configured to allow traffic based on source network, destination network, or port number, and in any combination.
The configuration of ACLs is a vitally important step for any network that will allow remote access, allowing in only the necessary traffic. ACLs are applied according to the first matching rule. The inclusion, as the final rule, of a rule to deny traffic from all sources to all destinations can establish an implicit Deny form of access control.
Access Control
Access control is just what it sounds like – determining who can and who cannot access network resources. Many different models can be used to assign user rights and privileges. As with all sensitive information, it is best to allow only the access needed. The model you adopt may be shaped by the level of protection the network resources require.
Mandatory Access Control
In mandatory access control, permissions are granted at a level that the user or running processes on the local computer are unable to override. A user in a system based on mandatory access control would not be able to share his or her own data with another user. The policy is set from above and applied. In mandatory access control environments, access to a resource will not be granted unless a rule exists specifically granting access. This is the strictest form of access control.
Discretionary Access Control
In discretionary access control, the owner of an object determines the ability of other users to access the object. Each file or folder has an owner, and there is no central authority for establishing who can access what data. Because this type of access control is easily subverted, and control of the data so diffuse, it is not normally recommended for environments with sensitive data.
Role/Rule-based Access Control
In the role-based access control model, users are assigned to roles, and those roles are granted permission to access resources. For instance, three part-time receptionists may have nearly identical permissions requirements. Rather than assigning the permissions to each receptionist individually, an administrator could assign those permissions to a receptionist role and assign the role to each of the receptionists.
These settings can be by department, by level of authority, by job role, or by any other criteria. A user can be assigned to multiple roles, and as long as any role has permissions to access a resource, the user will have the ability to access the resource. Role-based access control greatly simplifies the maintenance of user and group permissions.
Implicit Deny
Implicit Deny is an important security principle. A system can either default to granting access (open and insecure) or default to denying access (closed and secure). In those situations where a rule has not been configured to grant access, systems that must be secure should default to denying access. This “When in doubt, lock them out” practice ensures that resources do not accidentally open up to any and all users. Maintaining the implicit Deny is a basic security practice.
Time-of-Day Restrictions
Access can be restricted not just with object level or role-based permissions but also with time-of-day permissions. It may be necessary to allow different levels of access depending on the time of day. This may prevent changes to data while it is being backed up, or it may prevent access to restricted areas outside of normal office hours.
Trusted OS
The trusted OS is a concept relevant for extremely high security or sensitive systems. Because all of the operations of a computer rely on the OS to run, an untrustworthy OS can lead to a total compromise of all the data to which the computer has access. Operating systems can be designed, evaluated, and tested specifically to ensure they are trustworthy. A set of standards trusted operating systems seek to meet is known as the Common Criteria for Information Technology Security Evaluation (Common Criteria).
There is also an Evaluation Assurance Level (EAL) that ranks from 1 to 7. The higher an OS is ranked in EAL, the more rigorous testing the OS has been subjected to, and the better it has been shown to conform to the Common Criteria for trusted operating systems.
Mandatory Vacations
Mandatory vacations can be imposed on employees to ensure that another employee will occasionally review any work commonly done by the vacationing employee. This can help to deter or reveal any inappropriate conduct that an employee might otherwise be able to hide.
Job Rotation
Similarly, job rotation, in which employees regularly change job roles, can guarantee that each person’s work is regularly reviewed by another employee. This guarantees another set of eyes regularly reviewing any work, but this practice runs the risk of preventing specialization and deep proficiency in any job role.