Access Control #1 Flashcards
(24 cards)
What is Authentication?
Check if something or someone is who they say they are
What is Authorisation?
Permission granted to user to access resource
What is Access Control?
Authenticate, Authorise and take account of the actions of users
How is Access Control achieved?
Through policies
What 2 places can Access Control be applied?
Locally, Network
What are 2 examples of Access Control?
Code based approach, Database orientated approach
What is the code-based approach to Access Control?
Integrating Access Control into server’s Application Code
What is the database-orientated approach to Access Control?
Access Control delegated to database
What are the 3 main models of Access Control?
1) Discretionary Access Control (DAC) 2) Mandatory Access Control (MAC) 3) Role based Access Control (RBAC)
What are DAC, MAC and RBAC each defined by?
DAC = User, MAC = System, RBAC = Roles
In DAC, what do users own and control?
DAC, users own resources and control their own access
In DAC, can ownerships be shared and transferred?
Yes, in DAC ownership can be shared and transfered
In DAC, every object has a list, what is this called?
DACL (Discretionary Access Control List)
What does the DACL contain?
List of people and their access permissions
What does a DAC Matrix look like?
Vertical list of names, horizontal list of files
How does MAC classify subjects and objects?
By security levels (e.g. confidential, secret, top secret)
How do reading and writing permissions work in MAC?
Users can only read objects of equal or lower levels
In MAC, can access be shared and transferred?
No, subjects can’t transfer access rights
In MAC, what 2 details are kept about each object and user?
Users/Objects Clearance/Classification (e.g. top secret), and Need-to-Know/Category (e.g. Project z)
What happens when someone tries to access an object?
The OS checks the User’s clearance and Need-to-Know against the object’s classification and category to decide if they get access
In RBAC, what is access based on?
access is based on the user’s role in the organisation, e.g. teachers get these permissions
What are the 2 benefits of MAC?
1) Flexible 2) Little to no need of overarching admin
What is the benefit of DAC?
More secure than MAC
What are 2 benefits to RBAC?
1) Reduce user admin 2) Having a few roles and assigning them is far easier than MAC and DAC upkeep
