1 / 15

Access Controls

Access Controls. Supervised by: Dr.Lo’ai Tawalbeh Prepared by: Abeer Saif. Introduction:. Access Controls: The security features that control how users and systems communicate and interact with one another. Access: The flow of information between subject and object.

zola
Download Presentation

Access Controls

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Access Controls Supervised by: Dr.Lo’ai Tawalbeh Prepared by: Abeer Saif

  2. Introduction: • Access Controls: The security features that control how users and systems communicate and interact with one another. • Access: The flow of information between subject and object. • Subject: An active entity that requests access to an object or the data in an object. Such as a user, program, or process that accesses an object to accomplish a task.

  3. Introduction: • Object: A passive entity that contains information. Such as: a computer, database, file, computer program, directory, or field in a table in a database, etc.

  4. Introduction: • Access controls are extremely important because they are one of the first lines of defense used to fight against unauthorized access to systems and network resources. • Access controls give organizations the ability to control, restrict, monitor, and protect resource availability, integrity, and confidentiality.

  5. Access Control Administration: Two Basic forms: • Centralized: One entity is responsible for overseeing access to all corporate resources. Provides a consistent and uniform method of controlling access rights. • Decentralized: Gives control of access to the people who are closer to the resources. Has no methods for consistent control, lacks proper consistency.

  6. Centralized & Decentralized access:

  7. Access Control methods: • Access controls can be implemented at various layers of an organization, network, and individual systems. • Three broad categories: • Administrative • Physical • Technical (aka Logical)

  8. Access Controls ISA 2004 Internet Security & Acceleration Server 2004

  9. ISA 2004 overview:

  10. ISA 2004 overview: • ISA Server 2004 main roles: • Firewall. • Packet inspection & filtering. • Stateful inspection & filtering. • Application layer inspection & filtering. • VPN server. • Unified firewall & VPN Server. • Proxy and Caching server. • Forward cache. • Backward cache.

  11. ISA 2004 overview: • ISA Server 2004 as a VPN server: • VPN (Virtual Private Network):is a secure network connection created through a public network such as the Internet. • Types of VPN connections: • VPN clients. • Site-Site VPN. • Quarantine Control.

  12. ISA 2004 overview: • Why use VPN connections: • Availability. • Cost. • Internet Protocol security (IPSec):A set of industry-standard, cryptography based protection services and protocols. IPSec protects all protocols in the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol suite and Internet communications.

  13. ISA 2004 overview: • Protocols supported by ISA Server 2004: • Point-Point tunneling protocol (PPTP): • Uses Microsoft’s encryption (MPPE). • Less Complex to set than IPsec. • Layer two tunneling protocol (L2TP): • More secure than PPTP. • IPsec concepts more complex.

  14. ISA 2004 overview:

  15. References: • CISSP All-in-One Exam Guide. • Installing, Configuring, and Administering Microsoft Windows XP Professional. MCSA/MCSE Self-Paced Training Kit (Exam 70-270). • Implementing Microsoft Internet Security and Acceleration Server 2004. MCSA/MCSE Self-Paced Training Kit (Exam 70-350).

More Related