>> Authorization controls.
The learning objectives for this lesson are to
describe the different types of access control methods,
to evaluate authentication protocols,
and to describe identity proofing mechanisms.
Let's get started. The first type of
access control method we will discuss is
discretionary access control or DAC.
With DAC, the resource owner
determines who has access to everything.
DAC is very flexible and it's used by
default in Unix/Linux and Windows systems.
It's the weakest model because it requires
centralized administration and this
is difficult to enforce.
It's also vulnerable to
insider threats and compromised account abuse.
The next method is mandatory access control or MAC.
MAC is very different.
It's based on security clearance levels.
Labels are applied to objects and
subjects and each of these are granted a clearance level.
Labeling is performed using pre-established rules.
These rules cannot be changed by subject accounts.
MAC is also considered to be non-discretionary.
When you see a question on
the test and it mentions labels, it's MAC.
Also, a key point again is that it's non-discretionary.
A quick breakdown of how this would work is that
all data users would be given specific labels
and then those labels have their own rules as to
what they're allowed to access with those labels.
Everything is built on this system.
It's cumbersome to set up,
but it's very secure because it enforces,
hence the mandatory,
access on the data based on those labels.
Next, we have role-based access control or RBAC.
This is adding an additional element to
DAC based on the subject's roles.
Users can gain rights based on their roles.
For example, in a corporation,
the HR department may have additional access to data,
so all users that are in
that HR department role would have access to that.
We also have attribute-based access control, ABAC.
This is a more fine-grained approach as it
utilizes a combination of any attributes.
It also uses the eXtensible
Access Control Markup Language,
XACML.
If you see a question talking about XACML,
then you know that it's attribute-based
access control, ABAC.
Finally, we have rule-based access control.
This is where we have policies that are determined by
a system enforced rules rather than by system users.
Authentication protocols.
First, we have single sign-on or SSO.
This allows a user to authenticate
once to a local server and
then be authenticated to other servers
without having to enter in their credentials again.
Then we have Remote Authentication
Dial-In User Service or RADIUS.
This uses the UDP protocol
and it authenticates with a shared secret.
Next, we have diameter.
This is considered an improved version of RADIUS.
It's TCP based and it requires
IPSec and TLS for the confidentiality of the data.
It gets its name diameter because
it's considered to be twice as good as RADIUS.
We also have Terminal Access
Controller Access-Control System Plus or TACACS+.
This is a Cisco developed protocol.
It runs on TCP and port 49.
The data is encrypted and all AAA functions are discrete.
Next, we have Lightweight Directory
Access Protocol or LDAP.
This is a directory service protocol
that runs over TCP IP.
LDAP service uses a directory database to
determine who can and cannot access data,
or in some cases,
if you're allowed to authenticate to a network.
Finally, we have Secure LDAP or LDAPS.
This is simply LDAP that runs over SSL or TLS.
The next, we have the granddaddy of them all, Kerberos.
This is a single sign-on network authentication protocol.
It's used in Active Directory.
First, a client request services from a server.
Clients and servers both rely on
the Key Distribution or KDC for authentication.
The KDC has two parts.
The first is the Authentication Service
and the second is the Ticket Granting Service.
The KDC will issue what is known as a ticket
granting ticket for authentication,
the KDC runs on port 88 TCP or UDP.
Here's a simplified breakdown of Kerberos and Action.
First, the client asks for authentication to
the Kerberos Key Distribution Center or the KDC.
This is composed of
the Authentication Server and
the Ticket Granting Server,
it's asking for the Ticket Granting Ticket.
Authorization is given and
the TGT is then passed to the client.
The client uses the TGT,
the Ticket Granting Ticket to access the server,
that is what establishes authentication,
and then the server allows access.
Next, we have Open Authorization or OAuth.
This is often used for authentication and
authorization for a RESTful API.
A user account is hosted by one or more resource servers.
Authorization requests are
processed by authorization servers.
It uses JavaScript object notation or
JSON web token, JWT format.
It can be passed in URLs and
HTTP headers and can be
digitally signed to ensure authentication and integrity.
Extensible Authentication Protocol or EAP.
This provides a framework for deploying
different authentication protocols and system.
It mostly uses digital certificates
rather than passwords to help establish the trust.
802.1x, this uses EAP for
wireless Ethernet or VPN gateways
to provide authentication.
It has three parts. The first is the supplicate.
This is the device requesting access.
Then we have the network access server or NAS.
Don't confuse this with network attached storage.
This is edge equipment such as switches or access points.
Then finally, we have the Authentication,
Authorization and Accounting, or AAA server.
This is the server that authenticates the requests.
Identity Proofing Mechanisms.
Identity Proofing is verifying
that a user's various characteristics
and credentials are accurate
and unique to that individual.
Multi-factor Authentication uses one
or more of the following.
Something you know, which is usually a password,
something you have: a token or similar device,
something you are: biometrics.
We're all familiar with
Multi-factor Authentication in one form or another.
Oftentimes when you're accessing
your online bank accounts,
you may receive a text.
This would be something you have,
something that is sent to you.
That is an example of two-factor authentication.
Multi-factor is adding in even more than that.
You can add in a password to
authenticate and then you must
use a second password, say,
using OAuth or Google Authenticator,
and maybe sometimes you have to use a thumbprint.
This is something you are.
You can use a combination
of these things to help uniquely
identify a person and
ensure that you're letting the right person in.
We can also use two-step verification,
like I mentioned with the SMS before.
These are out of band mechanisms
that generate a token on the server side,
and then that's sent to a user.
Like I mentioned earlier, SMS messages,
phone calls, push notifications, or email.
HMAC Based One-Time Password,
or also known as HTOP,
is an algorithm for token-based authentication.
The client and server both share the same shared secret.
They're stored as an eight byte value
that generated by a random number generator.
The next we have is a Time-Based One-time Password,
or TOTP.
This is a refined version of HMAC,
by adding in a value taken from
the timestamp of both the client and the server.
This allows each token has
a short usage time, 30-60 seconds.
A good example of this is Google Authenticator.
Identity Proofing Mechanisms,
Hardware root of Trust RoT.
This is a trust anchor.
A secure subsystem that can provide attestation.
It's established using a Trusted Platform Module or TPM,
which is a hardware module to store
encryption keys or other forms of identification.
The TPMs are built usually
into the motherboard of a computer.
We also have JavaScript Object Notation,
JSON, Web Token, JWT.
This is a subset of JavaScript used in
the REST style of web app architecture.
JSON Web Tokens are
a method to transfer claims between two parties.
JWTs have a header, a payload,
and a signature separated by
dots and are expressed in Base64.
Let's summarize. We discussed
the different types of access control methods.
We presented the types of authentication protocols,
and we went over the different
types of identity proofing.
Let's do some example questions.
Which type of access control is used for
security clearance levels and utilizes labels?
Mandatory access control or MAC.
Question 2, this authorization protocol improves upon
RADIUS by adding a failover mechanism
and requiring IPSec and TLS?
Diameter. Remember, diameter is
considered to be twice as good as RADIUS.
Question 3, which type of token has
a built-in expiration for
each token to prevent future attacks?
Time-based one-time password or TOTP,
because they're only useful for that 30-60 second block.
Finally, Question 4,
which access control model is the most flexible and is
used by default in Unix/Linux and Windows systems?
Discretionary access control or DAC.
I hope that lesson was useful for
you, and I'll see you in the next one.