What refers to how consistently and reliably a connection system or other network resource can be accessed by authorized personnel?

Abstract

In general terms, providing security means “freedom from risk and danger”. In the context of information security, it is securing information against:

Keywords

• Access Control
• Smart Card
• Access Control Policy
• Security Guard
• Access Control Model

These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Introduction

In general terms, providing security means “freedom from risk and danger”. In the context of information security, it is securing against:

• Access to information by unauthorized persons

• Modification to information by unauthorized persons

• Destruction of information by unauthorized persons

This means basically, any type of access to information needs to be protected. Whether the access is physical such as accessing CPUs, hard disks, or logical, as in accessing the system directly or remotely, access needs to be restricted and thus, information needs to be protected.

Access control is considered the most important aspect of information security and is an important pillar of information security. Access control can be implemented in various ways depending on the environment. This may entail locking your computer room, your system, restricting access to the system using login and passwords, protecting your data using file protection or encryption, encrypting network communications, or checking a digital signature before accessing the data.

Access control has two components – authentication and authorization. Authentication is verifying the identity of a user or a host that is accessing the system or network resource. The goal of authentication is also determining from where and how the resource is being accessed – whether the system is being accessed from a private computer or public computer (internet café) or if it is being accessed during normal working hours or after working hours. Authorization is permitting or restricting access to the information based on the type of users and their roles – employee, contractor, administrator, or manager.

Examples of access control:

• Entering into a server room or data center using physical key or finger print authentication or by keying in the access code

• User prompted to provide username and password when accessing computing resources

• Remote user prompted to provide user name and password when accessing network from outside of the organization

• User denied access while accessing confidential documents related to the company or a client

• User denied access while accessing personnel related details

Confidentiality and Data Integrity

Different information or data in the organization has different sensitivities as far as confidentiality is concerned. Some data may be accessed by everyone as there is no security risk, even if it is known to the entire world. Other information may be highly confidential and may have to be shared only with a few individuals or be restricted to only a few individuals. Various levels of data sensitivity can be ensured only by controlling appropriate access through proper authentication and authorization.

Similarly, the integrity of the information/data is another important property that is protected through access controls. The importance of data integrity can be illustrated by a simple example. Imagine that you have made an online purchase of $100. By accident or deliberate intervention, your data has been modified and you receive a bill for $1000 – who will take the loss? In another example, your prescription drug dosage of 10 milligrams (mg) has been modified to 100 mg – imagine the consequences. Hence, one of the most important aspects of information security is the integrity of data – whether your data can be modified by all users or not, and any data should be possible to be modified by only authorized users.

Unauthorized modification or destruction of information leads to loss of integrity. Integrity concerns the origin of the source of information, and the correctness and completeness of information. Data Integrity protection can be provided by having preventive mechanisms as to who can access the system, appropriate access controls, and detective mechanisms in regards to who is trying to modify/destroy the data, preventive controls such as locking the systems down after a pre-specified number of unauthorized attempts. This leads to an important element of the overall guidance for information access at any organization – an Access Control Policy.

Who Can Access the Data?

Data is accessed by different types of users within an organization – the data owner, database administrator, data architect, and vendors. Each of them has a different role and function to perform on the data. For the database and its administrators, “data integrity” means to ensure that the data being entered in the database is accurate and consistent. The database designer/database administrator designs appropriate table structures, relations, and views and sets certain rules on them to ensure proper access to, and integrity of, data. For a data owner, “data integrity” means to ensure appropriate business rules that are defined on the data are intact and the data is being accessed as per the defined rules. For a vendor, “data integrity” means accuracy and consistency of the stored data. Between any two transactions and updates, data should not have been altered, and should have proper error checking and validation routines. There is no doubt that there are more definitions and meaning for “data integrity,” but they all mean the same thing – how or who accesses the information/data, and how information/data access can be protected and monitored.

There are different methods for protecting data integrity, such as generating checksums, file integrity software, and encryption. Checksum computes the sum of total digital data. This checksum is verified at both ends of the transmission. If there is no data integrity loss, then the checksum should be the same at both ends – before and after the transmission. There are several algorithms available for calculating the checksum. Most sites today offer either MD5 or SHA-1 checksum to users. File integrity software checks on by whom, how, and when the files have been accessed. It monitors the access of individual documents/files. You can set alerts when an unauthorized user tries to access any file or data. Encryption ensures both the integrity and confidentiality of data.

What is an Access Control?

An access control is a security feature that controls access to systems and resources in the network. The goal of an access control is to protect information from being lost, stolen, deleted, or modified either intentionally or accidently by those who are not authorized to access it. There are three methods of access:

• Network Access – Users on a network can access all the resources on the network. Hence, network access also needs to be restricted, protected, and monitored. For example, users who can access the HR and finance department LAN can be restricted.

• System Access – Users accessing the systems on the network. It can be one of the servers, printers, or any other shared device on the network. The access to these devices should be restricted, protected, and monitored continuously.

• Data Access – Users constantly accessing data on the network resource. Users accessing and modifying files, documents, and databases. Any data that is being accessed should be restricted, protected, and monitored.

The challenge of security programs is to ensure that data is not modified or deleted by unauthorized users. Although security programs cannot improve the quality of the data, they definitely can help in protecting data by applying access controls to ensure that any changes to data are intended and applied correctly. Access controls are a very critical requirement for both commercial and government organizations to prevent fraud and errors. It is imperative that no user can modify data in a way that renders the data corrupt or causes loss of financial integrity or make it unreliable for appropriate decision making. Examples of government systems include the Air Traffic Control system, Social Security, welfare system, IRS tax information, the birth and death registry, housing, and passport and military records. Examples of commercial systems include medical records, employee personal information, credit/financial reporting, the payroll system, income tax information, and customer details.

Data integrity can be protected by granting access to the resources on a need-to-know and need-to-do basis. Various types of users need different levels of access. For example, internal users may need full access whereas external users and contractors may need read-only access. Users should be granted access based on the roles, responsibilities, and job functions that they perform. Resources should also have different classification levels. For example, documents should be classified as confidential, private, public, or internal use only. A detailed log should be maintained so that in case of any fraud or data loss, logs can be reviewed to find out the root cause and the culprit. Access privileges should be judiciously granted on a need-to-know and need-to-do basis to ensure data is protected.

Authentication and Authorization

Authentication is the first step in granting access to a user for the resources. It is the process of identifying a user and verifying whether he/she is authorized to enter into the organizational network and access the resources. This is very similar to having a photo identification card check at the main entrance of the building. The user name and password are the most commonly used method to authenticate a user. The user name and password provides a relatively weak security as they can be stolen or guessed. Because of increasing threats to security, there are other methods introduced to complement the user name and passwords. Depending on the nature of business, one can consider implementing the appropriate authentication and authorization technique.

Authentication and authorization technologies involve:

• Proving who you are (identity card, smartcard)

• Verifying who you are (password, finger prints, etc.)

Authentication and Access Control Layers

Access control provides limits on who can access which resources and what he or she can do with it. The user needs to be identified before he can be given access to the organizational information. Access must first be granted by administrative policies, then the technical controls, and finally, physical access. There are various authentication techniques that organizations can implement and are broadly classified under three layers – administrative, technical, and physical, as shown in Figure 4-1.

Figure 4-1.

Access control layers

Full size image

Administrative Access Controls (Layer)

These controls are administrative in nature and are required to prevent the risk of improper or inappropriate access control or detect such improper or inappropriate access controls. These are ensured through policies and processes; appropriate description of roles and responsibilities; and proper segregation of duties.

Access Control Policy

Each organization has to clearly specify its philosophy of access control which becomes the basis for all access control activities. The policy provides absolute clarity as to the access control models the organization believes in, such as “discretionary,” “mandatory,” “non-discretionary,” or “hybrid”. Some of the attributes of such a policy are the clarity as to whether authorization provided can be further delegated or not. The policy may specify the ground rules for classification of information which becomes the base for the access control. Even though the content and depth of the access control policy may differ from one organization to another, broadly speaking, all access control policies set the tone of the organization’s intent and approach to access controls.

Personnel related – jobs, responsibilities, and authorities

Ideally, each job in the organization may require access to information for different purposes. Certain information must be only “read” by people so that they are aware of the information and/or for executing the information. Some others may require not only to “read” the information, but also to further “update” or “modify” it. Some others may require creation of new information, that is, “writing” the information to organizational repositories. Some may require all of these permissions. Again, there can be “individual” or “group” accesses defined based on the jobs and responsibilities. Authorities may rely on certain persons to further delegate their access or may clearly specify the contours of further delegation of access controls. Data owners are the ones who ideally decide on who, what, and when the data can be accessed, depending upon business requirements and enabling jobs, responsibilities, and authorities.

Segregation of duties

One of the important organizational requirements is to avoid fraud, such as that with financial connotation or frauds due to the violation of the organizational policies. For example, purchase value of an item increased by $1,000 may be a fraud from the perspective of financial implication, whereas the recruitment of a person by changing his qualification and experience or by editing a background verification report may be a violation of organization policy. Hence, it is necessary for there to be appropriate segregation of the duties where the policies have to be enforced and financial integrity has to be ensured. These responsibilities should lie with different individuals. Segregation of duties is traditionally one of the controls deployed by organizations and is important to be considered even while access authorization is provided.

Supporting policies and procedure

The organization also needs to ensure complementary controls through other supporting policies like the following: a) Hiring Policies, b) Disciplinary Policies, c) Employee Termination Policy, and d) User registration for computer access. These policies provide clear direction to the organizational personnel. For example, organizational hiring policies may clearly specify whom not to recruit, like those with criminal backgrounds and so on. Hiring policies may also specify the need for background clearance, such as address, criminal records, education, and earlier employment verification. Disciplinary policies may clearly specify which behaviors or acts of employees are not acceptable in the organization and what are the possible consequences of such violations. Similarly, an employee termination policy may specify when and for what reasons an employee’s services may be terminated. The policy on user registration for computer access may clearly specify the reason for accessing the information, so that the access is provided only upon verification of that intent. Each such policy supports the organization to set the discipline required for providing access to and use of information.

Control Over Information Access to Trade Restricted Persons

If you consider U.S. export laws, a few of the employees or contractors of these organizations may be from trade restricted countries or working in trade restricted countries. Some of the high-end technology and related technical documentation/information may not be shared with such personnel unless a specific license to share such information is obtained from the competent authorities. Proper administrative controls need to be put in place to identify, determine, and control access to such persons to ensure compliance and confidentiality.

Technical (Logical) Controls

Technical controls are usually introduced through or on technological products, tools, or utilities. These again help the organization to either prevent or detect or contain inappropriate and improper access controls. Some of these are passwords, smart cards, encryption, network access controls, and system access controls.

Passwords

Traditionally, passwords were the only form of access control. However, passwords were also easily prone to being guessed or cracked either because of the ignorance of the users or because of the inappropriate implementation of these on the networks or operating systems or on the applications. Strong passwords are one of the absolute requirements in today’s world which is technologically advanced and the technology can crack the passwords in a matter of seconds if they are found to be weak. The passwords can be “static,” “dynamic,” or a combination of both. A static password is one which is the same for each login. A dynamic password is one which is generated newly each time a user has to enter a password (normally generated using a soft token, a hard token, or by using SMS based interfaces). Some systems use a combination of both.

Smartcards

Smartcards normally complement password controls. These provide an additional layer of security by adding another layer to gain access. These may be implemented through various technologies like HID, RFID, or Chip-based smart cards.

Encryption

Data encryption protects information from the loss of confidentiality and integrity because it requires a key to decipher the encrypted information and this key is available only with the intended recipient. Encryption provides sufficient security to the information, either stored or transmitted, unless the encryption algorithm is weak, the encryption key is weak, or the encryption key is not well protected. Encryption, if well implemented, can provide access to only the authorized personnel.

Network Access

A network has many components like routers, switches, and cables. Network components are required to be hardened. Default passwords on them have to be changed. Strong authentication and handshake mechanisms have to be implemented in the network equipment like firewalls, intruder detection/prevention systems, and so on to ensure that only authorized users are allowed connections to be established, attempts by unauthorized users to penetrate are detected or declined. Network components have to ensure that they are establishing connections to only authentic or valid systems to which the connection is intended. Access to ports has to be provided for appropriately and all unwanted/unused ports have to be closed.

System Access

There are various levels of access possible to operating systems as well as to applications. These need to be set up appropriately on a need-to-know and a need-to-do basis. Giving administrative privilege to all users for operating systems can lead to serious infections or violations. Similarly, giving unlimited access to applications should be avoided or it will lead to serious integrity issues.

Physical Access Controls

Physical access controls are again one of the important layers of either preventive or detective controls which supplement or complement other forms of control in mitigating the risk of inappropriate or improper access and modifications to the information.

Network Segregation

For ease of understanding, let us assume that you are an IT service provider organization and you work for two competing banks. It is necessary that the information pertaining to one bank is not accidentally or intentionally accessed by the personnel who work for the other bank. Physical segregation of the two networks can help ensure high confidence to the customers.

Perimeter Security

Clearly identifying the organizational boundaries and ensuring that the perimeter is secured, restricts improper and inappropriate access to the organizational resources. Some of the important controls of use are electrical fences, microwave barriers, CCTV cameras, and sensor-based intrusion detection systems.

Security Guards

Security guards are the traditional sources of preventive and detective physical controls. Even today, these security guards provide the assurance of physical access controls by ensuring that the entry and exit controls are appropriately provided for and monitored. Activities such as the checking of identification cards/badges, ensuring that nobody tail gates employees, those without official badges are allowed access only after duly verifying their identity or visitors are allowed access only after due verification and where required only with an escort, monitoring the movement of employees and visitors in secure areas are some of the ways in which security guards are used. They can also ensure the securing and protecting of unlocked and unattended information assets like laptops. Other areas where they are used are for monitoring fire control panels and water leakages. However, for effective protection through security guards, proper background verification of these security guards needs to be ensured.

Badge Systems

Badges/identification cards are the traditional mechanisms used to control access and are still the popular means of providing access. Special/secure areas may require special types of badges or other complementary authentication mechanisms like smart cards, passwords, or biometric controls.

Biometric Access Controls

Biometric access controls use some physiological features/aspects of the human body to provide access to human beings. The features used to provide access differ from person to person such as finger print scans, iris scans, retina scans, palm scans, facial scans, and voice. Some of these, like finger prints and iris scans are widely used.

Access Control Strategies

Access control models are based on requirements, technology, and implementations. Different types of access control models exist. The most popular access control models are a Discretionary Access Control (DAC), Mandatory Access Control (MAC), Role Based Access Control (RBAC), and Attribute Based Access Control (ABAC).

Discretionary Access Control (DAC)

In this model, the access control is based on the owner’s discretion. The owner of the resource can decide to whom he/she should grant permission to access, and exactly what they are allowed to access. This is the most common model used in most of the file sharing utilities both in the Microsoft operating system and in UNIX. The CHMOD command in UNIX allows the user to share the files in the network. In DAC, the permission is granted to those who need access and it is classified as a “need-to-know” access model. One of the examples of this type of implementation is Access Control Lists (ACLs).

Mandatory Access Control (MAC)

In the Mandatory Access Control (MAC) model, shown in Figure 4-2, usually a group or a set of people are provided access based on the clearance given to a specific level of access depending on the classification of information/data. For example, data that is “top secret” is available to a set of people based on their clearance level to access “top secret” documents. Such people also have clearance to access lower level classified information, but, lower level cleared employees will not have access to a higher level of classified information. This does not grant them access without any restriction. In such a system, they are required to access the documents or information only on a “need-to-know” or on a “need-to-use” basis to fulfil their job related responsibilities. We can often find this model implemented in government organizations where the access depends on the sensitivity of the documents (secret, top secret, etc.), and the responsibilities of the individuals who are working on the project are clearly defined.

Figure 4-2.

Example of a Mandatory Access Control

Full size image

Role-Based Access Control (RBAC)

As the name suggests, access control is granted based on the roles and responsibilities of an individual working in the organization, that is, on a “need-to-do” or a “need-to-use” basis as shown in Figure 4-3. For example, an engineer’s role would be restricted to accessing design documents and software. He can add, delete, or modify his own data or code but cannot access the project level or production data. Also, he will not have access to the HR database or financial database. To cite another example, a customer service representative might require access to payment status, shipping details, or previous order history, in order to assist customers and may have “read” only access to such data as he is not required to modify these. Similarly, a system administrator will have a more privileged access to the system than the rest of the employees. However, a system administrator may not have a “root” access and password, because it has been restricted by his manager. An RBAC is the best system for a company that has a high employee turnover.

Figure 4-3.

A Role Based Access Control

Full size image

Attribute Based Access Control

Access can be granted using attributes – subject attributes like identity, roles; object attributes like device name, file, record, table, applications, programs, and network; environment conditions like location, time, and the like as shown in Figure 4-4. When the role assigned to a subject is used as the single attribute to control access, it is known as a Role Based Access Control (RBAC). An Attribute Based Access Control (ABAC) provides access on the basis of multiple attributes. NIST special publication 800-162:Footnote 1 “Guide to Attribute Based Access Control (ABAC) Definition and Considerations” defines RBAC as “an access control method where subject requests to perform operations on objects are granted or denied based on assigned attributes of the subject, assigned attributes of the object, environmental conditions, and a set of policies that are specified in terms of those attributes and conditions.”

Unlike identity based ACLs and the role based RBAC, ABAC does not attach access to either subjects or to roles directly. ABAC can dynamically check for various rules based on the subjects, objects, and other attributes specified and decide on granting access depending on a set of rules or policies specified in terms of those attributes and conditions. Rules or policies decide what operations are allowed for which type of subject on which type of objects and under what conditions. Operations can be read, written, deleted, modified, edited, and executed. ABAC allows policies, subjects, or objects to be created and managed separately yet relating them dynamically during the granting of access. Access Control Mechanisms make the decisions whether or not to grant access based on the applicable policies and attributes. The current global corporate setup with diversities and complicated structures, where multiple organizations work together collaboratively, the subject based access control policies and role based access control policies are difficult to be implemented effectively with respect to the intent of access controls. Of course, ABAC is not as simple and straight forward to implement. It is complex but very useful in providing better access controls. Some of the examples of ABAC are: Extensible Access Control Markup Language (XACML) and the Next Generation Access Control standard.1

Figure 4-4.

ABAC Access Control Mechanism

Full size image

Implementing Access Controls

In the following section we have described different mechanisms used for implementing access controls effectively.

Access Control Lists (ACLs)

Access Control Lists are the primitive choice for implementing access to network resources. These are implemented in the devices that provide access to a network. A network device or a computer system is configured with the rights that need to be provided to each user to each item on the network. Each resource has two basic rules – deny and allow. When an ACL is configured, for example, user1 is allowed to access a specific server in the network whereas user2 is denied access to the same server. This may seem like a simplistic approach, but the implementation may have several complex rules. Two levels of ACLs are implemented – file system level ACLs and Network level ACLs.

File System ACLs

Files have three basic rights – read, write, and execute, respectively allowing a user to read the contents of a file, write to the file, and execute the file if it is a program application or a script capable of running on the system. Further, the file access can be given at the user level as well as the group level. If a user belongs to a particular group, he or she has certain access to files and vice versa. In the case of file systems, a file or a directory may also have multiple access rules attached to it. In UNIX (and many other operating systems), access permission for every file and directory is controlled by two identifications – the User Identification number (UID) and the Group Identification number (GID). Every user has a unique user name and is a member of at least one group. This information is stored in a password file. Only the administrator can create or modify a user name and its permissions.

An example of the output that is produced by the ‘ls –l’ command is shown in Figure 4-5.

Figure 4-5.

ls – l command

Full size image

Field 1: A set of permission flags

Field 2: Link count

Field 3: Owner of the file

Field 4: Associated group

Field 5: Size of a file in bytes

Field 6–8: Date and Time of the last modification

Field 9: Name of the file

Network ACLs

Network ACLs, shown in Figure 4-6, provide secured access to a network. It acts as a network filter to filter out unnecessary traffic. It is not as sophisticated as a firewall or other network security devices, however, it provides the basic access security to a network. ACL filter enables you to control traffic into and out of your network. This control is as simple as permitting or denying hosts inside the organizational network. ACLs are normally configured at the access device such as routers or switches. When a packet arrives at the router, the router extracts the ACL rules and based on the ACL rule, the packet is permitted or denied (dropped). ACL is implemented at the network layer of the TCP/IP and OSI model.

ACLs consist of the permit/deny rule, source IP address, destination IP address, and the traffic type (IP or TCP). As soon as a packet enters the network, its source and destination addresses are checked against the ACL rule and based on the rule packet, it is either permitted or denied into the network. Advanced rules also check for the type of traffic. For example, the FTP uses TCP port 21 to transfer files and the Internet Message Access Protocol (IMAP) uses port 143, and secured e-mail port 22.

Figure 4-6.

Example of Network ACL

Full size image

AAA Framework

Authentication, Authorization, and Accounting (AAA), shown in Figure 4-7, is a security framework to support secured access to a network through the security services – Authorization, Authentication, and Accounting.

Authentication refers to the process of identifying and verifying a particular user by his profile such as the user name, password, phone number, digital signature, and digital certificates. Authentication is the way a user is identified and verified prior to being allowed access to particular resources inside an organizational network and its resources. After the authentication, a user’s authorized credentials are checked to provide the secured access.

Authorization determines whether a particular user is authorized to perform certain activities on the resources. Typically, this function is inherited from authentication when a user logs on to an application or a network. When a user logs on to the network, he is checked for his authorization credentials such as time restrictions, resource access restrictions, multiple access or single access, and same user logging from multiple locations at the same time.

Accounting provides resource utilization information related to users for the purpose of billing and cost allocation. By enabling the accounting feature, you can collect user identities, number of bytes transmitted and received, commands executed on the servers, and start and end times, for the purpose of a security audit.

AAA uses protocols such as RADIUS, TACACS+, or Kerberos to administer access controls. A typical configuration of AAA is as shown in Figure 4-7.

Figure 4-7.

AAA configuration

Full size image

RADIUS and TACAS+

Remote Authentication Dial-in-User Service (RADIUS) is a protocol enabling centralized AAA for network access. RADIUS protocol supports authentication, authorization, and accounting for remote dial-in access, virtual private network (VPN) access, Digital Subscriber Line (DSL) access, and other network access. The RADIUS protocol is described in RFC 2865 and RFC 2866.

RADIUS is a client/server protocol. A central RADIUS server authenticates RADIUS clients which try to access the network and its resources. The RADIUS server maintains user profiles and server access information in a central database, thus providing better access control security. It also allows companies to setup and maintain policies that can be applied to each user and to track resource usage for billing and for recording network statistics.

TACACS (Terminal Access Control System) is an authentication protocol commonly used in UNIX networks to allow a remote user to access the network after authenticating his login credentials. RADIUS uses UDP whereas TACACS+ uses TCP. Hence, many system administrators recommend TACACS+ because TCP is a reliable protocol. RADIUS combines authentication and authorization in a user profile, whereas TACACS+ separates the two functions. For more details, you can refer to RFC 1492.

LDAP and Active Directory

The Lightweight Directory Access Protocol (LDAP) is an application level protocol that defines the method by which information across an organization can be accessed. LDAP is often used by organizations to store user information for authentication and authorization purpose. It is also used for storing “roles” for information for application users.

LDAP is based on a client/server model. Any client accessing the network resources or an application must first authenticate itself to the LDAP server. Once the LDAP server authenticates the client and checks its resource authorization, only then is access permitted to the client. LDAP implementation can be based on RFC 1777, RFC 4510, RFC 4511, and RFC 2251.

The main benefit of LDAP is that rather than managing user lists for different applications and login IDs to access networks, LDAP can be used as a central directory where any user can be authenticated and authorized from anywhere on the network.

Active Directory is an LDAP compliant database and services are developed by Microsoft. This provides authentication and authorization services. An Active Directory stores information of the user, system, resource, or group as an object and is managed centrally. The objects are organized into organizational units (OUs) and are linked by Group Policy (GP) settings. Active Directory is a trademark of Microsoft service and is an integral part of the Windows 2000 architecture.

IDAM

Identity and Access Management (IDAM), shown in Figure 4-8, refers to the processes, technologies and policies for managing digital identities and providing authentication and authorization controls to ensure data integrity. An IDAM solution enables a single identity across organizations as well as partner networks.

An IDAM solution helps organizations to protect resources from unauthorized access, and to comply with security regulations. The goal of IDAM is to provide the right information to the right user at right time.

Figure 4-8.

The IDAM Framework

Full size image

IDAM is comprised of people, processes, and policies to manage user identity and access in an enterprise network. IDAM can be classified into four major categories: authentication, authorization, user management, and data management as shown above. The ultimate goal of IDAM is to provide secured access to the right user, to the right information, at the right time.

Active Directory (AD), Single Sign-On (SSO), Password Manager, Security Token Services (STS), OAuth, and RBAC are technologies and are related to the implementation of IDAM solutions.

Single sign-on (SSO) is a user authentication process that permits a user to enter his credentials only once in order to access multiple applications. The SSO process authenticates the user for all the applications that he has the rights to and eliminates the process of entering the login id and password when they switch to a different application during a particular session.

Chapter Summary

We examined what authentication and authorization mean. We explored the importance of access controls and the need for an access control in the context of confidentiality and integrity requirements.

We described the different access control types like network access, system access, and data access. Furthermore, we specified the three layers of access controls: administrative layer, technical (logical) layer, and the physical layer. Each of these layers serve as important mechanisms to control access to valuable information. Then, important access control methods like Discretionary Access Control (DAC), Mandatory Access Control (MAC), Role Based Access Control (RBAC), and Attribute Based Access Control (ABAC) were explored. Where required, the pros and cons of these are explained.

We discussed how the effective access controls can be implemented technically. Access Control Lists, AAA Framework, RADIUS and TACAS+, LDAP and Active Directory, and the IDAM Framework were explained in detail with supporting diagrams. Single Sign-On (SSO) as an important component of IDAM Framework was also explained.

Notes

1. 1.

   NIST special publication 800-162.

Author information

Authors and Affiliations

1. Bhubaneshwar Area, India

   Umesh Hodeghatta Rao & Umesha Nayak

Authors

1. Umesh Hodeghatta Rao

   You can also search for this author in PubMed Google Scholar

2. Umesha Nayak

   You can also search for this author in PubMed Google Scholar

Rights and permissions

Open Access This chapter is licensed under the terms of the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License (http://creativecommons.org/licenses/by-nc-nd/4.0/), which permits any noncommercial use, sharing, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence and indicate if you modified the licensed material. You do not have permission under this licence to share adapted material derived from this chapter or parts of it.

The images or other third party material in this chapter are included in the chapter’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the chapter’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

Reprints and Permissions

Copyright information

© 2014 Umesh Hodeghatta Rao

About this chapter

What refers to the capacity for a system to continue performing despite an unexpected hardware or software malfunction?

What is it called when an organization implements security procedures to protect the hardware network and software from intrusion?

What is any event large or small that has adverse effects on a network availability or resources?

What manages the resources on a network?