WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:0

00:30.040 --> 00:31.260
All right, let's take a look at module

00:31.290 --> 00:36.680
four, which deals with identification,
authentication and authorization.

00:37.280 --> 00:39.900
So first concept access control.

00:39.930 --> 00:42.420
Access control is the selective

00:42.450 --> 00:48.060
restriction of an asset of access
to an asset or numeric resource.

00:48.090 --> 00:51.980
So this is dictated
through an access attempt.

00:52.010 --> 00:56.320
The authorization information determines
whether or not the subject can access the

00:56.320 --> 00:59.620
object and the allowance of the denial
would be considered to be access control.

00:59.650 --> 01:04.460
So controlling the flow of information
between the subject and the object.

01:04.490 --> 01:06.720
Access control.

01:08.200 --> 01:10.260
All right, terminology.

01:10.290 --> 01:13.700
The subject is the entity that accesses.

01:13.730 --> 01:16.980
The object is the entity that is accessed.

01:17.010 --> 01:20.700
Information flows from the
object to the subject.

01:20.730 --> 01:25.100
The reference monitor is invoked
for every access attempt.

01:25.130 --> 01:27.780
So think of referee reference.

01:27.810 --> 01:30.490
When I try to access as a subject and

01:30.520 --> 01:33.290
object, the reference monitor
says hold on, not so fast.

01:33.320 --> 01:35.020
Who are you?

01:35.050 --> 01:37.540
Identification authentication.

01:37.560 --> 01:39.020
Now what are you trying to access?

01:39.040 --> 01:42.380
Let me check and see if you're authorized
if you're authorized, thumbs up.

01:42.410 --> 01:45.180
If you're not authorized, thumbs down.

01:45.210 --> 01:50.100
It should be invoked for every access
attempt and that's generally implemented

01:50.130 --> 01:52.700
through the security kernel,
the operating system.

01:52.730 --> 01:58.420
Then the operation is representing the
action taken by a subject on an object.

01:58.450 --> 02:01.260
So you have actions, you have abilities,

02:01.290 --> 02:03.620
and you have permissions,
which are data flow.

02:03.650 --> 02:06.930
So privileges are a combination of both

02:06.960 --> 02:11.580
rights the ability to take action on an
object permissions the ability to access

02:11.610 --> 02:17.400
the object collectively privileges
both rights and permissions.

02:18.320 --> 02:20.890
All right, some access control principles.

02:20.920 --> 02:22.100
More terminology.

02:22.130 --> 02:25.260
Separation of duties involves a breakdown

02:25.290 --> 02:28.380
of the authorization
process into various steps.

02:28.410 --> 02:33.500
Different privileges assigned at each step
to individuals requesting for a resource.

02:33.520 --> 02:37.220
Ensures that no single individual has the
authorization rights to perform all

02:37.250 --> 02:42.340
functions and simultaneously denies access
to all objects to a single individual.

02:42.370 --> 02:44.580
Long story short, you should never give

02:44.610 --> 02:49.380
any one entity too much ability, right,
because it gives them too much power.

02:49.410 --> 02:54.180
It also makes them
a single point of compromise.

02:54.210 --> 02:56.520
If you have one person doing everything in

02:56.520 --> 02:58.420
the network, what happens
if they get hit by a bus?

02:58.440 --> 03:00.380
Nobody there to perform the job duties.

03:00.410 --> 03:04.860
So you'll see, separation of duties
referred to inabilities and also job

03:04.890 --> 03:10.220
tasks, permissions and
access to resources.

03:10.250 --> 03:15.500
You need to know you should only know
what you need to know to do your job.

03:15.530 --> 03:19.940
That goes hand in hand with the principle
of least privilege, which means you should

03:19.970 --> 03:23.180
only have enough to do
your job and nothing more.

03:23.200 --> 03:25.220
And that's the principle
of least privilege.

03:25.250 --> 03:28.180
So only enough access to do your job, no

03:28.210 --> 03:33.060
more, no less, which is that's pretty hard
to actually achieve, but we do our best.

03:33.090 --> 03:38.000
So based on the need to know principle

03:38.520 --> 03:42.820
all right, access Control models
a mandatory access control.

03:42.850 --> 03:46.860
Only the administrator system owner
has rights to assign privileges.

03:46.890 --> 03:51.820
Discretionary access Control end user has
complete access to the information they

03:51.850 --> 03:55.020
own and can provide
access to other entities.

03:55.050 --> 03:56.820
Role based access control.

03:56.850 --> 03:58.900
Permissions are based on user roles.

03:58.930 --> 04:01.260
So, for example, administrator, backup

04:01.290 --> 04:04.820
operator, programmer,
et cetera, et cetera.

04:04.850 --> 04:06.820
Based on your job tasks.

04:06.850 --> 04:09.580
Rule based Access Control are permissions

04:09.610 --> 04:14.260
assigned dynamically based on a set of
rules defined by the administrator.

04:14.290 --> 04:18.500
And the best example that is not
an identity based access control.

04:18.530 --> 04:20.940
One of your better examples of rule based

04:20.970 --> 04:27.120
access control are firewall rules
or router access controllers.

04:28.200 --> 04:31.880
All right, logical
implementation of Mac and Rbac.

04:31.880 --> 04:33.420
You're going to be doing labs on this.

04:33.450 --> 04:39.860
So your Mac implementation user
Account Control Tool of Windows OS.

04:39.890 --> 04:42.980
This allows you to provide so logical

04:43.010 --> 04:46.940
implementation of Access Control in
general performed using Access Control

04:46.970 --> 04:50.660
lists, group policies, passwords
and account restrictions.

04:50.690 --> 04:55.360
So you can use Mac User Account Control to

04:55.390 --> 04:59.860
determine whether or not know after
you're allowed to run the DAC.

04:59.890 --> 05:02.140
Implementation is typically achieved

05:02.160 --> 05:07.680
through Windows file permissions
assignments or Access Control lists.

05:08.120 --> 05:12.740
The role based access control can be
implemented through just enough

05:12.770 --> 05:16.260
administration can also be implemented
through Windows Admin Center.

05:16.280 --> 05:20.100
And again, you're going to be
doing labs on all of those.

05:20.130 --> 05:21.280
All four of those.