Cyberstudy
PDF p.16 In progress

Access Control

Open PDF at p.16 17 flashcards

Summary

PDF p.16

Access control systems ensure that information systems meet the goals of the CIA triad (Confidentiality, Integrity, Availability). They govern how subjects (users, devices, processes) interact with objects (resources like networks, servers, databases). Modern access control is typically implemented through Identity and Access Management (IAM) systems, which include processes for identification, authentication, authorization, and accounting.

In plain words

Supplementary — not from your PDF

Access control decides which subjects (people, devices, processes) can do what to which objects (files, servers, databases). IAM does it in four steps: Identification (who are you?), Authentication (prove it), Authorization (what are you allowed to do?) and Accounting (what did you do?).

Detailed explanation

PDF p.16
  • Access Control System
    • Purpose: Ensures information systems meet CIA triad goals.
    • Subjects: People, devices, software processes requesting access.
    • Objects: Resources such as networks, servers, databases, apps, files.
    • Permissions: Rights assigned to subjects for accessing resources.
  • Identity and Access Management (IAM)
    • Identification
      • Definition: Creating an account or ID representing the user, device, or process.
      • Example: Unique user accounts on a network.
    • Authentication
      • Definition: Proving the identity of a subject attempting to access a resource.
      • Example: Passwords for people, digital certificates for systems.
    • Authorization
      • Definition: Determining and enforcing rights on resources.
      • Models
        • Discretionary: Object owner allocates rights.
        • Mandatory: System-enforced rules predetermine rights.
    • Accounting
      • Definition: Tracking and alerting on the usage of resources.
      • Example: Recording customer actions on an e-commerce site.

Important terms

taken from the text above
Subjects
People, devices, software processes requesting access.
Objects
Resources such as networks, servers, databases, apps, files.
Permissions
Rights assigned to subjects for accessing resources.
Identification
Creating an account or ID representing the user, device, or process.
Authentication
Proving the identity of a subject attempting to access a resource.
Authorization
Determining and enforcing rights on resources.
Discretionary
Object owner allocates rights.
Mandatory
System-enforced rules predetermine rights.
Accounting
Tracking and alerting on the usage of resources.
IAM Identity and Access Management

Examples & real-world scenarios

Supplementary — not from your PDF
  • Identification: typing a username.
  • Authentication: entering the password or scanning a fingerprint.
  • Authorization: file permissions let a user read a report but not edit it.
  • Accounting: the server logs that the user opened the report at 09:14.

Scenario

An employee signs in to the HR portal with a username (identification) and a password plus an app code (authentication). They can view their own payslip but get 'access denied' on a colleague's (authorization). Every view is logged (accounting).

Common mistakes

Supplementary — not from your PDF
  • Mixing up identification (claiming an identity) with authentication (proving it).
  • Mixing up authentication (who you are) with authorization (what you may do).
  • Forgetting accounting. Without records you can't investigate misuse or prove what happened.

Practical skills

Supplementary — not from your PDF
  • Label each step of a login and file-access flow with the matching IAM process.

What I should remember

Key Points PDF p.16
  • Access Control System
    • CIA Triad: Confidentiality, Integrity, Availability.
    • Subjects and Objects: Interaction governance.
    • Permissions: Rights assignment.
  • IAM Processes
    • Identification: Unique representation of users/devices.
    • Authentication: Proving identity.
    • Authorization: Rights determination and enforcement.
    • Accounting: Usage tracking and alerting.
  • E-commerce Example
    • Identification: Verify legitimate customers.
    • Authentication: Unique accounts management.
    • Authorization: Valid payment mechanisms, special offers.
    • Accounting: Record customer actions.