IS06- Access Control

IS06- Access Control - Access Control Pintu R Shah In this...

Info iconThis preview shows pages 1–10. Sign up to view the full content.

View Full Document Right Arrow Icon
Access Control Pintu R Shah
Background image of page 1

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
In this unit. . • Access control principles • ACL • DAC Pintu R Shah MPSTME SVKM's NMIMS • MAC • Role based Access Control • Access control models • Kerberos 2
Background image of page 2
Introduction • Controlling access to resources is one of the central themes of security. • The goal of AC is to protect an organization’s resources from unauthorized access while facilitating seamless and legitimate use of these resources. Pintu R Shah MPSTME SVKM's NMIMS Access control is about the relationships between subjects and objects. The transfer of information from an object to a subject is called access. Subjects are active entities that, through the exercise of access, seek information about or data from passive entities, or objects. 3
Background image of page 3

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
How AC helps Security Management? • AC enables management to – Specify which users can access the systems – Specify what resources they can access pecify what operations they can perform Pintu R Shah MPSTME SVKM's NMIMS – Specify what operations they can perform – Provide individual accountability 4
Background image of page 4
Access control principles • AC policy • Usually based on two standard practice – Separation of duties Pintu R Shah MPSTME SVKM's NMIMS – Least privilege • Also AC policy is based on sensitivity of data 5
Background image of page 5

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Classification of controls Physical Locks Removal of floppy and CD-ROM drives Security guards controlling access to facility and equipment Computer chassis locks Technical (logical) ncryption Pintu R Shah MPSTME SVKM's NMIMS Encryption Passwords and tokens Biometrics Operating system and application controls Identification and authorization technologies Administrative Policies and procedures Security awareness training Quality assurance 6
Background image of page 6
Access control characteristics Control Service Description Preventative Keep undesirable events from happening Detective Identify undesirable events that have taken place Pintu R Shah MPSTME SVKM's NMIMS Corrective Correct undesirable events that have taken place Deterrent Discourage security violations from taking place Recovery Restore resources and capabilities after a violation or accident 7
Background image of page 7

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Control combinations Detective – Administrative Job rotation Sharing responsibilities Inspections Incident response Use of auditors etective echnical S Pintu R Shah MPSTME SVKM's NMIMS Detective – Technical IDS Reviewing audit logs Forensics Detective – Physical Human evaluation of output from sensors or cameras Motion detectors, intrusion detection, video cameras Guard responding to alarm 8
Background image of page 8
Control examples Deterrent Preventati ve Detective Corrective Recovery Administrat ive Policy User registration Review violation reports Termination DR plan echnical arning asswd ogs, IDS nplug, ack ups Technical Warning banner Passwd based login Logs, IDS Unplug, isolate, terminate connection Back ups Physical Beware of Dog sign Fence CCTV Fire extinguisher Reconstr uction Pintu R Shah MPSTME SVKM's NMIMS 9
Background image of page 9

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Image of page 10
This is the end of the preview. Sign up to access the rest of the document.

This note was uploaded on 09/04/2011 for the course IT 100 taught by Professor Rickdas during the Spring '11 term at University of Mumbai.

Page1 / 61

IS06- Access Control - Access Control Pintu R Shah In this...

This preview shows document pages 1 - 10. Sign up to view the full document.

View Full Document Right Arrow Icon
Ask a homework question - tutors are online