Title: Class Outline 4
Course: KVCC BUS214 > Section: Class Outlines

Module 2

1.      Access Control

a.      Three entities

a.      Objects - data, software, systems, networks, physical space

b.      Subjects - users, applications, or process that access the objects

c.      System - policies, procedures, and technologies that control the objects

b.      Processes

a.      Identification - identifying an individual

b.      Authentication - validating identity

c.      Authorization - giving/denying access based on the user level rights

d.      Auditing/Accounting - keeping records of what is done

i.           AAA of access control

c.      Controls

a.      Preventive Access Controls

b.      Detective Access Controls

c.      Corrective Access Controls

d.      Deterrent Access Controls

e.      Recovery Access Controls

f.       Compensative Access Controls

d.      Classification based on restrictions

a.      Administrative

b.      Technical

c.      Physical

e.      Access Control Models

a.      Mandatory Access Control (MAC)

i.           Labels

1.      Classification Labels

2.      Clearance Labels

3.      Alignment

4.      Access control is mandatory

b.      Discretionary Access Control (DAC)

i.           Discretionary Access Control List DACL

ii.           Can pass permissions on to others

c.      Role Based Access Control (RBAC)

i.           Roles defined by job description

d.      Rule Set-Based Access Control (RSBAC)(RBAC)

i.           Examining characteristics

e.      Federated Access Control

i.           Federated Identity Management

f.       Authentication

a.      Type 1 Something you know

i.           Cognitive

ii.           One-Time Passwords

1.      HMAC based one-time password HOTP

2.      Time based one-time passwords TOTP

b.      Type 2 Something you have

i.           Smart Cards

ii.           Types of token based authentication

1.      Static password

2.      Synchronous Dynamic password

3.      Asynchronous Dynamic password

4.      Challenge response

iii.           Smart card certificates

1.      One-to-one

2.      One-to-many

c.      Type 3 Something you are

i.           Biometrics

1.      Universality

2.      Uniqueness

3.      Permanence

4.      Collectability

5.      Performance

6.      Circumvention

7.      Acceptability

d.      Type 4 Somewhere you are

i.           RFID

ii.           GPS

iii.           WI-FI Triangulation

e.      Type 5 Something you do

Attached Files: | - KVCC BUS214_InfoSystemsSecurity_Outline 4.pdf