Chao-Hsien Chu, Ph.D. College of Information Sciences and Technology

1. Access Control: Part II Chao-Hsien Chu, Ph.D. College of Information Sciences and Technology The Pennsylvania State University University Park, PA 16802 chu@ist.psu.edu Theory  Practice Learning by Doing IST 515

2. Access Control Process • Identification: Method of establishing the subject’s (user, program, process) identity. - Use of user name or other public information. - Know identification component requirements. • Authentication: Method of proving the identity. - Something a person is, has, or does. - Use of biometrics, passwords, passphrase, token, or other private information. • Authorization: Determines and gives the authenticated users the proper right to access the requested resources. Identification Authentication Authorization

3. Step 1: Identification • Identification is the assurance that the entity (e.g., user) requesting access is accurately associated with the role or subject defined within the system. • Identification is a critical first step in applying access controls. It is necessary to identify the users for downstream activities and controls. • Accountability • Audit trail • Trace individual activities

4. Types of Identification • The most common form of identification is a username, user ID, account number, or personal identification number (PIN). • To ensure the authorized application is making the requests to potentially sensitive resources, they can use digital identification such as certificate or one time session identifier. • Other types of identification include tokens, smart card or smart devices, biometric devices, and badges for visual and physical access.

5. Essential Identification Practices • Uniqueness: User identification must be unique so that each person can be positively identified. • Nondescriptive. User identification should not expose the associated role or job function of the user (e.g., root, admin, web master, and cfo). • Issuance: The process of issuing identifiers must be secure and documented. If an identity can be inappropriately issued, the entire system begins to break down. The entire process must be logged and documented to ensure the process can be verified and audited.

6. Step 2: Authentication There are three types of factors/information can be used for authentication: • Authentication by knowledge – What a person knows. Something you know (e.g., a password). • Authentication by ownership – What a person has. Something you have (e.g., a token or smart card). • Authentication by characteristic – What a person is or does. Something you are or do (e.g., biometrics).

7. Types of Authentication • Single-factor authentication employs one of the three factors, which is usually associated with a username and password combination. • Two-factor authentication uses two of the three factors. It usually introduce an additional level of technical controls in the form of physical or biometric device. It can include one-time passwords. • Three-factor authentication uses all three factors and, as such, include something about the user such as biometric features.

8. What a Person Knows What a person knows can be associated with the user ID or other unique identifier: • Password is typically a short (5 to 15 characters) string of characters that the user must remember to authenticate against their unique identifier. • Passphrase allows the user to utilize an easier to remember phrase (sentence) as a password without sacrificing the integrity. It supports all types of characters and spaces and is longer to enter and typically harder to attack.

9. Techniques to Attack Passwords • Electronic monitoring • Access the password file • Brute Force Attacks • Dictionary Attacks • Social Engineering • What are the differences between a password checker and a password cracker? • What are the potential legal issues?

10. The Protection of Password • The more diverse (or complicated) the password is, the more difficult it will be to guess or crack the password. • Password must never be passed over a network or stored in cleartext. Moreover, the storage of passwords must be protected. • To protect passwords from being exposed, they are typically hashed. Hash function is inherently one-way, which means that a hash results cannot be deciphered to produce the original data. • However, the time to discover a password by means of a password cracker is directly related to the complexity of the password and the employment of the hashing algorithm.

11. What a Person Has • Typically is a physical device (such as a token, a memory card or a smart card) that can be used in lieu of a password or in addition to a password. The objective is to add another layer of confidence that the user is who he or she claims by the assurance a physical device offers. • Asynchronous: Asynchronous token device is essentially a challenge response technology. Dialogue is required between the authentication service and the remote entity. • Synchronous: Synchronous token authentication is based on an event, location, or time-based synchronization between the requestor and authenticator.

12. Authentication Devices • Memory Cards. The cards hold user authentication information, but does not process information. The user only needs to type in a user ID or PIN and present the memory card for approval. E.g., swipe card or the ATM card. Moreover, data stored on the card is not protected. • Smart Card is a card that has an embedded semiconductor chip that accepts, stores, process and sends information. It. can hold more data than magnetic-stripe cards. Also, small applications can be incorporated into the memory to provide various functions. Smart cards can be contact or contactless.

13. Authentication - Biometrics • Uses a unique person attribute or behavior (e.g., what a person “is”) to verify her/his identity. • Biometric considerations: • Resistance to counterfeiting • Data storage requirements • User acceptance (due to privacy concern). • Reliability and accuracy.

14. Type of Biometrics Behavior • Voice • Keystroke • Signature Physiological • Fingerprint • Hand • Face • Iris • DNA Biometric systems can be divided in two main classes:

15. Biometric Accuracy Measurement Accuracy or the ability to separate authentic users from imposters is essential for Biometric systems. • False rejection rate (Type I Error). Authorized users are rejected as unidentified or unverified. • False acceptance rate (Type II Error). Unauthorized persons are accepted as authentic. This is an important error to avoid. • Crossover Error Rate (CER). The point at which the false reject rate and false acceptance rate are equal. The smaller the value of the CER, the more accurate the system.

16. Biometric Accuracy Measurement • The lower the sensitivity, the more prone the system is to false acceptance. Not sensitive enough, and anyone is authorized; too sensitive, and no one get through.

17. One Time Passwords • Also know as Dynamic Passwords, aone-time password (OTP) is a password that is valid for only one login session or transaction. OTPs are not vulnerable to replay attacks. • OTP generation algorithms typically make use of randomness. It can be generated in software (soft tokens) based on time-synchronization between the authentication server and the client, a mathematical algorithm, or a hardware.

18. Step 3: Authorization • Once the subject provides its credentials and is properly identified, the system access needs to determine if this subject has been given the necessary right to carry out the requested actions and authorize it. • Access Criteria can be thought of as: • Roles – assign rights based on roles • Groups – assign the right to groups • Location – assign rights to specific location • Time od day – assign based on the time • Transaction Types – assign rights to specific transaction.

19. Challenges of Authorization Common problems encountered in controlling access to assets include: • Different levels of users with different levels of access (e.g., manager vs. staff). • Resources may be classified differently • Diverse identity data and devices (interoperability issue). • Corporate environments keep changing (maintenance issue).

20. Authorization - Single Sign On (SSO) Capabilities: Allow user credentials to be entered one time and the user is then able to access all resources in primary and secondary network domains Technologies: • Kerberos – is an authentication protocol based on a symmetric key cryptography technology, which has been widely used in operating systems. • SESAME – based on both asymmetric and symmetric key cryptography. • Security Domains • Directory Services • Dumb Terminals / Thin Clients

21. Access Control Categories • Each control works at a different level of granularity, but can also perform several functions • Access Control Functionalities/Categories: - Preventive, to avoid incidents • Deterrent: to discourage incidents - Detective: to identify incidents - Corrective: to remedy circumstance; mitigate damage and restore controls - Recovery: to restore conditionals to normal - Compensation: as an alternative control (Supervision)

22. Types of Control • Access controls can be implemented at various layers of an organization, network, and individual systems • There are three broad categories (types) of access control: • Administrative: Defines the roles, responsibilities, policies, and administrative functions to manage the control environment. • Physical: The operating environment, such as doors, locks, fire management, gates and guards. • Technical (aka Logical). Firewalls, filters, operating systems, applications, and routing protocols.

23. Administrative Controls • Personnel security, evaluation, and clearances: • Separation of Duties • Rotation of Duties • Mandatory Vacation • Security Policies • Operational policies and Procedures • Monitoring • User Management • Security Awareness Training • Privilege Management • Testing • Change Management • Business Continuity & Disaster Management • Performance • Configuration Mgmt. • Vulnerability Mgmt. • Product Life-cycle Mgmt. • Network Management

24. Physical Controls • Perimeter Security • Physical Entry • Computer Controls / Information Processing Center • Work Area Separation • Data Backups • Cabling • Control Zone

25. Technical (Logical) Controls • User Controls • System Access • Network Architecture • Network Access • Remote Access • Application Access • Malware Control • Encryption and Protocols • Auditing

26. Access Control Administration • Step 1: Choose the access control model (DAC, MAC, RBAC). • Step 2: Select and implement different access control technologies. • Step 3: Access Control Administration. • Centralized • Decentralized

27. Centralized Access Control • One entity is responsible for overseeing access to all corporate resources. • Provides a consistent and uniform method of controlling access rights. • Protocols: Agreed upon ways of communication • Attribute Value Pairs: Defined fields that accept certain values. • Types of Centralized Access Control • RADIUS • TACACS (Terminal Access Controller Access-Control System) • DIAMETER

28. RADIUS • RADIUS is a server for remote user authentication and accounting. Its primary use is for Internet Service Providers, though it may as well be used on any network that needs a centralized authentication and/or accounting service for its workstations. • The package includes an authentication and accounting server and some administrator tools.

29. TACACS+ • TACACS+ is an entirely new protocol and not compatible with TACACS or XTACACS. • TACACS+ uses the Transmission Control Protocol (TCP) and RADIUS uses the User Datagram Protocol (UDP). Some administrators recommend using TACACS+ because TCP is seen as a more reliable protocol. Whereas RADIUS combines authentication and authorization in a user profile, TACACS+ separates the two operations.

30. Example of Centralized Control DIAMETER extends the base protocol by adding new commands and/or attributes, such as those for use of the Extensible Authentication Protocol (EAP).

31. Decentralized Access Control • Gives control of access to the people who are closer to the resources, as in department managers and sometimes users. • Has no methods for consistent control, lacks proper consistency. • Nonstandardization and overlapping rights, which may cause gaps in security control.

32. Example of Decentralized Control

33. Access Control Practices • Security professionals need to know the access control tasks that need to be accomplished regularly to ensure satisfactory security. • Best practices used in industry include: - Deny access to anonymous accounts - Enforce strict access criteria - Suspend inactive accounts - Replace default passwords - Enforce password rotation - Audit and review - Protect audit logs

34. Threats to Access Control • Denial of service • Buffer Overflows • Insiders • Mobile code • Malicious software • Password crackers • Spoofing / masquerading • Sniffers • Eavesdropping • Emanations • Shoulder surfing • Tapping • Object reuse • Data remanance • Unauthorized targeted data mining • Dumpster diving • Backdoor/trapdoor • Theft • Intruders • Social engineering

35. Threats to Access Control • Emanation is the proliferation or propagation of a signal. This is most evident in wireless networks. A wireless network antenna may radiate the signal to areas beyond the desired scope, such as out of a building and into the parking lot. If this were to occur, an attacker could drive to the location and attempt to access the network from the privacy of his vehicle, potentially undetected. • Data Remanence is the remains of partial or even the entire data set of digital information. Normally, this refers to the data that remains after the media is written over or degaussed.

36. Countermeasure to Emanation Security • TEMPEST refers to standardized technology that suppresses signal emanations with shielding material. The devices (monitors, computers, printers, and so on) have an outer metal coating, referred to as a Faraday cage. This is made of metal with the necessary depth to ensure only a certain amount of radiation is released. • White noise is a uniform spectrum of random electrical signals. It is distributed over the full spectrum so the bandwidth is constant and an intruder is not able to decipher real information from random noise or random information. • Control Zone uses material in their walls to contain electrical signals. This prevents intruders from being able to access information emitted via electrical signals from network devices.

37. Access Control Monitoring • Three Common Components: - Sensors - Analyzers - Administrator Interfaces • Common Types: - Intrusion Detection - Intrusion Prevention - Honeypots - Network Sniffers

38. Intrusion Detection Systems (IDS) IDS is a technical solution whose role is to detect suspicious activity and report on the findings. IDS is a reactive warning system that provides information necessary to guide administrators in responding to the attack. Two Main Types of Intrusion Detection Systems: • Network Based (NIDS) is a network device, or dedicated system attached to the network, that monitors traffic traversing the network segment for which it is integrated. NIDS is usually incorporated into the network in a passive architecture. • Host Based (HIDS) is the implementation of IDS capabilities at the host level. Its most significant difference from NIDS is intrusion detection analysis, and related processes are limited to the boundaries of the host.

39. Intrusion Detection Systems (IDS) HIDS and NIDS can be: • Signature Based • Statistical Anomaly Based IDS • Protocol Anomaly Based • Traffic Anomaly Based • Rule Based

40. Intrusion Prevention Systems (IPS) • The next big thing • Is a preventative and proactive technology, IDS is a detective technology. • Two types: - Network Based (NIPS) - Host Based (HIPS)

41. Access Control Monitoring • Honeypots: An attractive offering that hopes to lure attackers away from critical systems • Network sniffers: A general term for programs or devices that are able to examine traffic on a LAN segment.

42. Accountability • Accountability is tracked by recording user, system, and application activities. • Audit information must be reviewed - Event Oriented Audit Review - Real Time and Near Real Time Review - Audit Reduction Tools - Variance Detection Tools - Attack Signature Tools

43. Practical Projects • RBAC for Banking. • RBAC for Healthcare. • RBAC for Critical Systems. • Comparatives analysis of different access control techniques. • Deployment of RBAC Mechanism. • Semantic Access Control.