Access control3


Published on

Published in: Technology, Business
  • Be the first to comment

  • Be the first to like this

Access control3

  1. 1. Access Control Systems &Methodology 1
  2. 2. Topics to be covered Overview  Tokens/SSO Access control  Kerberos implementation  Attacks/Vulnerabilities/Monitoring Types of access control  IDS MAC & DAC  Object reuse Orange Book  TEMPEST Authentication  RAS access control Passwords  Penetration Testing Biometrics 2
  3. 3. What is access control? Access control is the heart of security Definitions:  The ability to allow only authorized users, programs or processes system or resource access  The granting or denying, according to a particular security model, of certain permissions to access a resource  An entire set of procedures performed by hardware, software and administrators, to monitor access, identify users requesting access, record access attempts, and grant or deny access based on pre-established rules. 3
  4. 4. Access control nomenclature Authentication  Process through which one proves and verifies certain information Identification  Process through which one ascertains the identity of another person or entity Confidentiality  Protection of private data from unauthorized viewing Integrity  Data is not corrupted or modified in any unauthorized manner Availability  System is usable. Contrast with DoS. 4
  5. 5. How can AC be implemented?  Hardware  Software  Application  Protocol (Kerberos, IPSec)  Physical  Logical (policies) 5
  6. 6. What does AC hope to protect? Data - Unauthorized viewing, modification or copying System - Unauthorized use, modification or denial of service It should be noted that nearly every network operating system (NT, Unix, Vines, NetWare) is based on a secure physical infrastructure 6
  7. 7. Proactive access control Awareness training Background checks Separation of duties Split knowledge Policies Data classification Effective user registration Termination procedures Change control procedures 7
  8. 8. Physical access control Guards Locks Mantraps ID badges CCTV, sensors, alarms Biometrics Fences Card-key and tokens Guard dogs 8
  9. 9. AC & privacy issues Expectation of privacy Policies Monitoring activity, Internet usage, e- mail Login banners should detail expectations of privacy and state levels of monitoring 9
  10. 10. Varied types of AccessControl Discretionary (DAC) Mandatory (MAC) Lattice/Role/Task Formal models:  Biba  Clark/Wilson  Bell/LaPadula  Used set theory to define the concept of a secure state, the modes of access, and the rules for granting access. 10
  11. 11. Problems with formal models Based on a static infrastructure Defined and succinct policies These do not work in corporate systems which are extremely dynamic and constantly changing None of the previous models deals with:  Viruses/active content  Trojan horses  firewalls Limited documentation on how to build these systems 11
  12. 12. MAC vs. DAC Discretionary Access Control  You decided how you want to protect and share your data Mandatory Access Control  The system decided how the data will be shared 12
  13. 13. Mandatory Access Control Assigns sensitivity levels, labels Every object is given a sensitivity label & is accessible only to users who are cleared up to that particular level. Only the administrators, not object owners, make change the object level Generally more secure than DAC Orange book B-level Used in systems where security is critical, i.e., military Hard to program for and configure & implement 13
  14. 14. Mandatory Access Control(Continued) Downgrade in performance Relies on the system to control access Example: If a file is classified as confidential, MAC will prevent anyone from writing secret or top secret information into that file. All output, i.e., print jobs, floppies, other magnetic media must have be labeled as to the sensitivity level 14
  15. 15. Discretionary Access Control Access is restricted based on the authorization granted to the user Orange book C-level Prime use is to separate and protect users from unauthorized data Used by Unix, NT, NetWare, Linux, Vines, etc. Relies on the object owner to control access 15
  16. 16. Access control lists (ACL) A file used by the access control system to determine who may access what programs and files, in what method and at what time Different operating systems have different ACL terms Types of access:  Read/Write/Create/Execute/Modify/Delete/Rename 16
  17. 17. Orange Book DoD Trusted Computer System Evaluation Criteria, DoD 5200.28-STD, 1983 Provides the information needed to classify systems (A,B,C,D), defining the degree of trust that may be placed in them For stand-alone systems only 17
  18. 18. Orange book levels A - Verified protection  A1  Boeing SNS, Honeywell SCOMP B - MAC  B1/B2/B3 C - DAC  C1/C2 D - Minimal security. Systems that have been evaluated, but failed 18
  19. 19. Bell-LaPadula Formal description of allowable paths of information flow in a secure system Used to define security requirements for systems handling data at different sensitivity levels *-property - prevents write-down, by preventing subjects with access to high level data from writing the information to objects of lower access 19
  20. 20. Bell-LaPadula Model defines secure state  Access between subjects, objects in accordance with specific security policy Model central to TCSEC (TCSEC is an implementation of the Bell-LaPadula model) Bell-LaPadula model only applies to secrecy of information  identifies paths that could lead to inappropriate disclosure  the next model covers more . . . 20
  21. 21. Biba Integrity Model Biba model covers integrity levels, which are analagous to sensitivity levels in Bell- LaPadula Integrity levels cover inappropriate modification of data Prevents unauthorized users from making modifications (1st goal of integrity) Read Up, Write Down model - Subjects cannot read objects of lesser integrity, subjects cannot write to objects of higher integrity 21
  22. 22. Clark & Wilson Model An Integrity Model, like Biba Addresses all 3 integrity goals  Prevents unauthorized users from making modifications  Maintains internal and external consistency  Prevents authorized users from making improper modifications T - cannot be Tampered with while being changed L - all changes must be Logged C - Integrity of data is Consistent 22
  23. 23. Clark & Wilson Model Proposes “Well Formed Transactions”  perform steps in order  perform exactly the steps listed  authenticate the individuals who perform the steps Calls for separation of duty 23
  24. 24. Problems with the Orange Book Based on an old model, Bell-LaPadula Stand alone, no way to network systems Systems take a long time (1-2 years) to certify  Any changes (hot fixes, service packs, patches) break the certification Has not adapted to changes in client-server and corporate computing Certification is expensive For the most part, not used outside of the government sector 24
  25. 25. Red Book Used to extend the Orange Book to networks Actually two works:  Trusted Network Interpretation of the TCSEC (NCSC-TG-005)  Trusted Network Interpretation Environments Guideline: Guidance for Applying the Trusted Network Interpretation (NCSC-TG-011) 25
  26. 26. Authentication3 types of authentication: Something you know - Password, PIN, mother’s maiden name, passcode, fraternity chant Something you have - ATM card, smart card, token, key, ID Badge, driver license, passport Something you are - Fingerprint, voice scan, iris scan, retina scan, DNA 26
  27. 27. Multi-factor authentication 2-factor authentication. To increase the level of security, many systems will require a user to provide 2 of the 3 types of authentication. ATM card + PIN Credit card + signature PIN + fingerprint Username + Password (NetWare, Unix, NT default) 3-factor authentication -- For highest security Username + Password + Fingerprint Username + Passcode + SecurID token 27
  28. 28. Problems with passwordsInsecure - Given the choice, people will choose easilyremembered and hence easily guessed passwords such asnames of relatives, pets, phone numbers, birthdays, hobbies,etc.Easily broken - Programs such as crack, SmartPass,PWDUMP, NTCrack & l0phtcrack can easily decrypt Unix,NetWare & NT passwords. Dictionary attacks are only feasible because users choose easily guessed passwords!Inconvenient - In an attempt to improve security,organizations often issue users with computer-generatedpasswords that are difficult, if not impossible to rememberRepudiable - Unlike a written signature, when a transaction issigned with only a password, there is no real proof as to theidentity of the individual that made the transaction 28
  29. 29. Classic password rules The best passwords are those that are both easy to remember and hard to crack using a dictionary attack. The best way to create passwords that fulfill both criteria is to use two small unrelated words or phonemes, ideally with a special character or number. Good examples would be hex7goop or -typetin Don’t use:  common names, DOB, spouse, phone #, etc.  word found in dictionaries  password as a password  systems defaults 29
  30. 30. Password management Configure system to use string passwords Set password time and lengths limits Limit unsuccessful logins Limit concurrent connections Enabled auditing How policies for password resets and changes Use last login dates in banners 30
  31. 31. Password Attacks Brute force  l0phtcrack Dictionary  Crack  John the Ripper Trojan horse login program 31
  32. 32. Biometrics Authenticating a user via human characteristics Using measurable physical characteristics of a person to prove their identification  Fingerprint  signature dynamics  Iris  retina  voice  face  DNA, blood 32
  33. 33. Advantages of fingerprint-based biometrics Can’t be lent like a physical key or token and can’t be forgotten like a password Good compromise between ease of use, template size, cost and accuracy Fingerprint contains enough inherent variability to enable unique identification even in very large (millions of records) databases Basically lasts forever Makes network login & authentication effortless 33
  34. 34. Biometric Disadvantages Still relatively expensive per user Companies & products are often new & immature No common API or other standard Some hesitancy for user acceptance 34
  35. 35. Biometric privacy issues Tracking and surveillance - Ultimately, the ability to track a persons movement from hour to hour Anonymity - Biometric links to databases could dissolve much of our anonymity when we travel and access services Profiling - Compilation of transaction data about a particular person that creates a picture of that persons travels, preferences, affiliations or beliefs 35
  36. 36. Practical biometricapplications Network access control Staff time and attendance tracking Authorizing financial transactions Government benefits distribution (Social Security, welfare, etc.) Verifying identities at point of sale Using in conjunction with ATM , credit or smart cards Controlling physical access to office buildings or homes Protecting personal property Prevent against kidnapping in schools, play areas, etc. Protecting children from fatal gun accidents 36
  37. 37. Tokens Used to facilitate one-time passwords Physical card SecurID S/Key Smart card Access token 37
  38. 38. Single sign-on User has one password for all enterprise systems and applications That way, one strong password can be remembered and used All of a users accounts can be quickly created on hire, deleted on dismissal Hard to implement and get working Kerberos, CA-Unicenter, Memco Proxima, IntelliSoft SnareWorks, Tivoli Global Sign-On, x.509 38
  39. 39. Kerberos Part of MIT’s Project Athena Kerberos is an authentication protocol used for network wide authentication All software must be kerberized Tickets, authenticators, key distribution center (KDC) 39
  40. 40. Kerberos roles KDC divided into Authentication Server & Ticket Granting Server (TGS) Authentication Server - authentication the identities of entities on the network TGS - Generates unique session keys between two parties. Parties then use these session keys for message encryption 40
  41. 41. Kerberos authentication User must have an account on the KDC KDC must be a trusted server in a secured location Shares a DES key with each user When a user want to access a host or application, they request a ticket from the KDC via klogin & generate an authenticator that validates the tickets User provides ticket and authenticator to the application, which processes them for validity and will then grant access. 41
  42. 42. Problems with Kerberos Each piece of software must be kerberized Requires synchronized time clocks Relies on UDP which is often blocked by many firewalls Kerberos v4 binds tickets to a single network address for a hosts. Host with multiple NIC’s will have problems using tickets 42
  43. 43. Attacks Passive attack - Monitor network traffic and then use data obtained or perform a replay attack.  Hard to detect Active attack - Attacker is actively trying to break-in.  Exploit system vulnerabilities  Spoofing  Crypto attacks Denial of service (DoS) - Not so much an attempt to gain access, rather to prevent system operation  Smurf, SYN Flood, Ping of death  Mail bombs 43
  44. 44. Vulnerabilities Physical Natural  Floods, earthquakes, terrorists, power outage, lightning Hardware/Software Media  Corrupt electronic media, stolen disk drives Emanation Communications Human  Social engineering, disgruntled staff 44
  45. 45. Monitoring IDS Logs Audit trails Network tools  Tivoli  OpenView 45
  46. 46. Intrusion Detection Systems IDS monitors system or network for attacks IDS engine has a library and set of signatures that identify an attack Adds defense in depth Should be used in conjunction with a system scanner (CyberCop, ISS ) for maximum security 46
  47. 47. Object reuse Must ensure that magnetic media must not have any remnance of previous data Also applies to buffers, cache and other memory allocation Required at TCSEC B2/B3/A1 level Secure Deletion of Data from Magnetic and Solid- State Memory, Objects must be declassified Magnetic media must be degaussed or have secure overwrites 47
  48. 48. TEMPEST Electromagnetic emanations from keyboards, cables, printers, modems, monitors and all electronic equipment. With appropriate and sophisticated enough equipment, data can be readable at a few hundred yards. TEMPEST certified equipment, which encases the hardware into a tight, metal construct, shields the electromagnetic emanations WANG Federal is the leading provider of TEMPEST hardware TEMPEST hardware is extremely expensive and can only be serviced by certified technicians Rooms & buildings can be TEMPEST-certified TEMPEST standards NACSEM 5100A NACSI 5004 are classified documents 48
  49. 49. Banners Banners display at login or connection stating that the system is for the exclusive use of authorized users and that their activity may be monitored Not foolproof, but a good start, especially from a legal perspective Make sure that the banner does not reveal system information, i.e., OS, version, hardware, etc. 49
  50. 50. RAS access control RADIUS (Remote Authentication Dial-In User Service) - client/server protocol & software that enables RAS to communicate with a central server to authenticate dial-in users & authorize their access to requested systems TACACS/TACACS+ (Terminal Access Controller Access Control System) - Authentication protocol that allows a RAS to forward a users logon password to an authentication server. TACACS is an unencrypted protocol and therefore less secure than the later TACACS+ and RADIUS protocols. A later version of TACACS is XTACACS (Extended TACACS). 50
  51. 51. Penetration Testing Basically Improving the Security of Your Site by Breaking Into it, by Dan Farmer/Wietse Venema  cracking.html Identifies weaknesses in Internet, Intranet, Extranet, and RAS technologies  Discovery and footprint analysis  Exploitation  Physical Security Assessment  Social Engineering 51
  52. 52. Penetration Testing Attempt to identify vulnerabilities and gain access to critical systems within organization Identifies and recommends corrective action for the systemic problems which may help propagate these vulnerabilities throughout an organization Assessments allow client to demonstrate the need for additional security resources, by translating exiting vulnerabilities into real life business risks 52
  53. 53. Rule of least privilege One of the most fundamental principles of infosec States that: Any object (user, administrator, program, system) should have only the least privileges the object needs to perform its assigned task, and no more. An AC system that grants users only those rights necessary for them to perform their work Limits exposure to attacks and the damage an attack can cause Physical security example: car ignition key vs. door key 53
  54. 54. Implementing least privilege Ensure that only a minimal set of users have root access Don’t make a program run setuid to root if not needed. Rather, make file group-writable to some group and make the program run setgid to that group, rather than setuid to root Don’t run insecure programs on the firewall or other trusted host 54
  55. 55. Access Control Systems &Methodology Any questions? Files graciously shared by Ben Rothke. Reformatted and edited for Slide presentation 55