Title: Access Control
Course: IN 2001 Principle of Information Assurance > Section: Module 6: Chapter Six

Access Control
1. Access control is the method by which systems determine if a user should be admitted to a system.
2. There are three types of access control systems: mandatory, non-discretionary and discretionary.
3. Mandatory Access Control scheme’s use of data classification schemes for granting access to data. Also, mention that the lattice-based access control is a variation of MAC, where administrators grant access to users to particular areas of access.
4. Nondiscretionary access control as a strictly enforced version of MAC managed by a central authority and access is based on either the individual’s role (role-based controls) or a set of tasks (task-based controls).
5. Discretionary access controls implement access control at the discretion of the data user and the most common example is Microsoft Windows.

Identification
1. Identification is a mechanism whereby an unverified entity—called a supplicant—that seeks access to a resource proposes a label by which they are known to the system.
2. The label applied to the supplicant must be mapped to one and only one entity within the security domain.

Authentication
1. Authentication is the validation of a supplicant’s identity. There are four general forms of authentication to consider:
  - What a supplicant knows
  - What a supplicant has
  - What a supplicant is
  - What a supplicant produces
2. The concept of what a supplicant knows.
  - A password is a private word or combination of characters that only the user should know
  - One of the biggest debates in the information security industry concerns the complexity of passwords
  - A password should be difficult to guess but must be something the user can easily remember
  - A passphrase is a series of characters, typically longer than a password, from which a virtual password is derived
3. The concept of what a supplicant has.
  - The second area of authentication addresses something the supplicant carries in his or her possession—that is, something they have
  - These include dumb cards, such as ID cards or ATM cards with magnetic stripes that contain the digital (and often encrypted) user personal identification number (PIN), against which the number a user inputs is compared
  - An improved version of the dumb card is the smart card, which contains a computer chip that can verify and validate a number of pieces of information instead of just a PIN
  - Another device often used is the token, a card or key fob with a computer chip and a liquid crystal display that shows a computer-generated number used to support remote login authentication
  - Tokens are synchronous or asynchronous
  - Once synchronous tokens are synchronized with a server, both devices (server and token) use the same time or a time-based database to generate a number that is displayed and entered during the user login phase
  - Asynchronous tokens use a challenge-response system, in which the server challenges the supplicant during login with a numerical sequence
4. The concept of who a supplicant is.
  - The process of using body measurements is known as biometrics and includes:
    - Fingerprint comparison of the supplicant’s actual fingerprint to a stored fingerprint
    - Palm print comparison of the supplicant’s actual palm print to a stored palm print
    - Hand geometry comparison of the supplicant’s actual hand to a stored measurement
    - Facial recognition using a photographic ID card, in which a human security guard compares the supplicant’s face to a photo
    - Facial recognition using a digital camera, in which a supplicant’s face is compared to a stored image
    - Retinal print comparison of the supplicant’s actual retina to a stored image
    - Iris pattern comparison of the supplicant’s actual iris to a stored image
  - Among all possible biometrics, only three human characteristics are usually considered truly unique:
    - Fingerprints
    - Retina of the eye (blood vessel pattern)
    - Iris of the eye (random pattern of features in the iris: freckles, pits, striations, vasculature, coronas and crypts)
  - Most of the technologies that scan human characteristics convert these images to some form of minutiae, which are unique points of reference that are digitized and stored in an encrypted format when the user’s system access credentials are created
5. The concept of what a supplicant produces.
  - The fourth and final area of authentication includes signature recognition and voice recognition
  - Retail stores use signature recognition, or at least signature capture, for authentication during a purchase.  Currently, the technology for signature capturing is much more widely accepted than that for signature comparison, because signatures change due to a number of factors, including age, fatigue and the speed with which the signature is written
  - In voice recognition, an initial voiceprint of the user reciting a phrase is captured and stored. Later, when the user attempts to access the system, the authentication process will require the user to speak this same phrase so that the technology can compare the current voiceprint against the stored value

Authorization
1. Authorization is the matching of an authenticated entity to a list of information assets and corresponding access levels, which can happen in one of three ways.
  - Authorization for each authenticated user, in which the system performs an authentication process to verify each entity and then grants access to resources for only that entity.  This quickly becomes a complex and resource-intensive process in a computer system
  - Authorization for members of a group, in which the system matches authenticated entities to a list of group memberships, and then grants access to resources based on the group’s access rights. This is the most common authorization method
  - Authorization across multiple systems, in which a central authentication and authorization system verifies entity identity and grants it a set of credentials

Accountability
1. Accountability or auditability is a system that directly attributes the actions on a system with an authenticated entity.