>> Welcome back.
>> Now we'll talk about authorization.
>> I always think of authorization as
the so what of all of the IAM stuff.
You have identified and authenticated.
The important thing is that you are
now authorized to access.
Authorization is what you're allowed to do
>> based on your identity.
>> Ultimately, how is it
>> that you gain access to resources?
>> The way that happens is through
>> what we refer to you as an access control model.
>> Operating systems and other applications
>> are built on these models and the models
>> dictate how subjects can access an object.
These are built into the operating system
>> and are part of the security policy of the system.
>> One of the earliest references
>> for computer system evaluation criteria
>> was referred to as the Orange Book.
It hasn't been used since the 1990s,
but there was a book called
the Trusted Computer System Evaluation Criteria.
It was a part of a collection of books
>> called The Rainbow Series.
>> Every book in the series had a different color cover,
and this one was orange.
But the point of this book
>> was to allow for systems to be certified
>> based on their security criteria or security functions.
>> How secure a system was
would dictate its Orange Book rating.
If I were a government agency,
perhaps I could only work with a vendor
>> who had a C2 rating on it's system
>> or something like that.
>> It's very desirable for vendors
>> to get certified via the Orange Book.
>> We go into this more in the CISSP course.
But for now, it's good for you to know that
>> this was an important book to determine
>> whether or not certain systems
>> could be used in federal environments.
They specified two security levels in the Orange Book.
One was Discretionary Access Control or DAC.
The other was Mandatory Access Control or MAC.
Obviously, mandatory is going to be more secure.
But keep in mind that on every system
has to be the most secure system on the planet.
There's a place for Mandatory Access Control systems,
but Discretionary Access systems
have their place as well.
Now, there are also
some other access control models
that were not defined by the Orange Book.
These are ways that certain environments allow
access from a subject to an object.
They are really not on par with DAC and MAC,
but we'll talk about these last three as well.
RBAC, ABAC, and RuBAC or RuBAC.
>> Let's start with DAC.
>> Most of us have experience with
Discretionary Access Control systems,
Windows-based systems or DAC,
Linux systems with the exception of Secure Linux,
and iOS systems or DAC systems.
Discretionary Access Control is called that because
the security of the object is
at the discretion of the object's owner.
If you create a folder,
you own the folder and you control access to it.
You can give access to anyone you want.
Since you own the folder,
you get to choose the security for that object.
You could put highly sensitive information
>> in the folder and then you could share it
>> with whomever you like.
>> It's not really geared towards security
>> as much as it is towards ease of use.
>> These Access Control Lists, or ACLs,
>> contain the rules of how permissions are granted.
>> You know how you can right-click on a file or folder
>> and you go to Properties
>> and you can see the list of users who have full control
>> or read-only control and so forth?
>> Those are ACLs.
You'll always associate them with the DAC environment.
A MAC environment is much more secure
>> and it's designed for the protection of sensitive data
>> or classified information.
In a MAC system, as an object is created,
that object gets a security label.
If the object contains top-secret information,
it gets a top-secret label.
Then if you have a user who has
access to secret level information,
that person would have a security label
for secret information.
When that person tries to access
>> the top-secret information,
>> the user wouldn't be able to access it
>> because the labels don't match.
>> Unlike a DAC environment,
the owner of the information doesn't have
the ability to add a user or change a label.
The operating system is in charge in a MAC environment.
All decisions are made by the operating system
>> based on comparing the labels.
>> With MAC, you'll be using
an operating system like Secure Linux or Solaris,
which are software extensions
>> that are referred to as trusted extensions.
>> That allows Solaris to look at security labels
>> and make decisions and operate in a MAC environment.
>> The labels indicate clearance level and classification.
Or they can indicate need to know.
There could be other label types.
But these are the ones we are the most familiar with.
You have a much more secure environment
with Mandatory Access Control.
I really think of DAC and MAC as
being in a category by themselves.
An operating system is designed to be MAC or DAC.
It's built into the security code
of the operating system.
There are other access control models.
To me, these are more like implementations.
By that, we could provide access to someone
based on their role in the organization
instead of their name.
Like instead of giving Jane Doe access
>> based on her name,
>> she could be given access based on being Trainer 1.
That would be Role Based Access Control.
That isn't built into the operating system.
But we could administer that operating system
>> using Role Based Access Control.
>> A lot of places do.
>> Your group users based on
their role within the organization.
That's RBAC or RBAC.
There's also something called
Attribute Based Access Control,
or ABAC or ABAC.
This uses certain characteristics of the user,
like the person's location or
tenure within the organization.
In this case, we're basing the access on
some characteristics associated with the account.
We also have RuBAC,
which is Rule-based Access Control.
Now, don't worry about getting
an RBAC or ABAC and RuBAC confused,
because they will normally spell
>> the acronym on the test.
>> Now, Rule-based Access Control
is simply what firewalls use.
Firewalls use rules to determine access.
If traffic is from the 10 network,
>> then block it.
>> If traffic is coming in on port 80,
then allow it.
>> That's RuBAC.
>> To recap on authorization,
we talked about how a subject is
authorized to access an object.
We talked about how that is driven
>> by the operating system
>> and the means of access control that gets configured.
>> Your operating systems are primarily going to be
>> based on either Discretionary Access Control
>> or Mandatory Access Control.
Most of the really common ones,
like Windows systems are on DAC.
But MAC is found on
high-security systems that use security labels
>> and run on operating systems like
>> Secure Linux or Solaris with trust extensions.
Finally, we have Rule-based Access Control,
Role Based Access Control,
and Attribute Based Access Control as well.