Access Control, Authentication, and Public Key Infrastructure Lesson 8 Access Control for Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 1 Learning Objective Implement appropriate access controls for information systems within information technology (IT) infrastructures. Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 2 Key Concepts The three states of data File system access control lists User account type privilege management Access control best practices Organization-wide layered infrastructure access control Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 3 DISCOVER: CONCEPTS Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. The Three States of Data Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Data at Rest (DAR) Stored on some device Archived records Data in Motion (DIM) Sending an e-mail Retrieving a Web page Data in Process Creating a new document Processing a payment DIM Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Use encryption to protect stored data: Elements in databases Files on network and shared drives Files on portable or movable drives, Universal serial bus (USB), and flash drives Files and shared drives accessible from the Internet Personal computers (PCs), laptop hard drives, and full disk encryption Protecting DAR Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Difficult to protect since it is being operated on by the central processing unit (CPU) Protecting DIP Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. File System Access Controls File system access controls will include logging of user activities on the: Files Applications Systems Access Controls at Different Levels in a System Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Trust-Based Peer to Peer (P2P) Workgroup Role-Based Access Group-Based Files Access Types of File System Access ...

1. Access Control, Authentication, and Public Key Infrastructure
Lesson 8
Access Control for Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
1
Learning Objective
Implement appropriate access controls for information systems
within information technology (IT) infrastructures.
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.

2. 2
Key Concepts
The three states of data
File system access control lists
User account type privilege management
Access control best practices
Organization-wide layered infrastructure access control
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
3
DISCOVER: CONCEPTS
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
The Three States of Data
Page ‹#›
Access Control, Authentication, and PKI

3. © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Data at Rest (DAR)
Stored on some device
Archived records
Data in Motion (DIM)
Sending an e-mail
Retrieving a Web page
Data in Process
Creating a new document
Processing a payment

4. DIM
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Use encryption to protect stored data:
Elements in databases
Files on network and shared drives
Files on portable or movable drives, Universal serial bus (USB),
and flash drives
Files and shared drives accessible from the Internet
Personal computers (PCs), laptop hard drives, and full disk
encryption
Protecting DAR
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.

5. Difficult to protect since it is being operated on by the central
processing unit (CPU)
Protecting DIP
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
File System Access Controls
File system access controls will include logging of user
activities on the:
Files
Applications
Systems
Access Controls at Different Levels in a System
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Trust-Based Peer to Peer (P2P)
Workgroup
Role-Based Access

6. Group-Based Files Access
Types of File System Access Controls
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Microsoft (MS) Windows versus UNIX
File system controls in MS Windows and UNIX are different,
but used to accomplish the same objective–control access to
data assets
Types of File System Access Controls (Continued)
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Windows Folder Permissions
Folder security properties in Windows 8
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.

7. 3/30/2015
12
Windows Folder Permissions
Editing folder permissions in Windows 8
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
3/30/2015
13
Windows Folder Permissions
Windows 8 advanced file permissions
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.

8. 3/30/2015
14
UNIX-based Rights
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
3/30/2015
15
Changing UNIX File Permissions
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
3/30/2015
16

9. DISCOVER: PROCESS
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Layered Protection Through IT Infrastructure
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Layered Protection Through IT Infrastructure (Continued)

10. DMZ 2
DMZ 1
Dual DMZ Configuration
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
DISCOVER: ROLES
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Roles and ResponsibilitiesRoleResponsibilitiesSystem
OwnerOwns System
Authorizes access
Performs non-technical access control reviewNetwork

11. Administrator
Managing host security, file permissions, backup and disaster
recovery plans, file system integrity, and adding and deleting
users
Troubleshoot networks, systems, and applications to identify
and correct malfunctions and other operational
difficultiesSystem AdministratorGrants access to system,
applications, and data
Provides special access as required
Creates groups and assigns users and privileges
Provides backup and recovery capabilities of systems,
applications, and data
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Roles and Responsibilities
(Continued)RoleResponsibilitiesApplication OwnerGrants
access to applications that manipulate data
Maintains integrity of applications and processesData
OwnerMaintains data integrity
Authorizes distribution to internal and external partiesUserUses
systems, applications, and data to perform functions
Creates file
Assigns data classification
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company

12. www.jblearning.com
All rights reserved.
Summary
Three states of data
Protecting DIM and DAR
File system access controls
User account type privilege management
Layered protection
Roles and responsibilities
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Virtual Lab
Managing Linux Accounts
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
If your educational institution included the Jones & Bartlett
labs as part of the course curriculum, use this script to introduce
the lab:

13. "In this lesson, you learned about user rights and file
permissions. You also explored how access controls are
implemented in various operating systems, such as Microsoft
Windows and UNIX-based systems.
In the lab for this lesson, you will create new user accounts on a
Linux virtual machine and grant administrator privileges to one
of those user accounts. You will also create two new security
groups, add user accounts to those groups, and then delete one
of those user accounts."
3/30/2015
24
Connection from
Internet
Firewall
External Router
Border Firewall Only
Internal Network
Connection from Internet
Router
Connection from Internet
Access Control, Authentication, and Public Key Infrastructure
Lesson 7
Human Nature and Organizational Behavior
© ITT Educational Services, Inc. All rights reserved.
Page ‹#›
IS404 Access Control, Authentication and PKI (PKI)

14. © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10
1
1
Learning Objective and Key Concepts
Learning Objective
Define proper security controls within the User Domain to
mitigate risks and threats caused by human behavior.
Key Concepts
Human resources access control considerations
User Domain security practices for human resources
Best practices for managing human risks
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10
2

15. 2
DISCOVER: CONCEPTS
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10
3
Type of ThreatOrganizations Reporting IssueRogue
Modems47%Media Downloading40%Personal
Devices40%Unauthorized Blogging25%Personal Instant
Messaging (IM) Accounts24%
10 Prevalent Insider Threats (Continued)
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10

16. 4
Type of ThreatOrganizations Reporting IssueRogue Modems47
%Media Downloading40 %Personal Devices40 %Unauthorized
Blogging25 %Personal Instant Message (IM) Accounts24 %
10 Prevalent Insider Threats (Continued)
Source: Edward Cone, Baseline magazine, March 25, 2009
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10
5
User Domain Access Control Management
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10

17. 6
Account Type
Justification for Secure Access
Internal User
Accountability, Auditing, and Assurance
The actions of each user’s account must be capable of being
irrefutably linked to the account and the user assigned to that
account.
Non-repudiation
External Remote User
Third Party
Privileged and System Accounts (Administrators)

18. Secure Network Access Considerations
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10
7
DISCOVER: PROCESS
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10
8

19. Pre-Employment Checks
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10
9
What Information Can Be Considered
What Information Cannot be Considered
Applicant’s Rights
Consequences of a Bad Hiring Decision

20. Ongoing Observation of Personnel
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10
10
Identify Potentially Disgruntled Employees
Proper Ways to Revoke Access upon Employee Termination

21. DISCOVER: ROLES
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10
11
Roles and Responsibilities
Human Resources Department
Recruiting, retention, separation, development, promotion,
welfare, and safety, health, and environment
Hiring Department Manager/Supervisor
Work specifications, data and application access, work
supervision and review, promotion, reward, and discipline
Employee
Job knowledge and application, compliance with employment
policies and procedures, and loyalty and ethical behavior
Page ‹#›
Access Control, Authentication, and PKI

22. © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10
12
DISCOVER: RATIONALE
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10
13
Security Awareness Training Facts
Information technology (IT) security surveys conducted by
well-known accounting firms found the following:
Many organizations have some awareness training.
Most awareness programs omitted important elements.
Less than 25% of organizations had no way to track awareness

23. program effectiveness.
Source: http://www.lumension.com/Resources/Resource-
Center/Protect-Vital-Information-Minimize-Insider-Risks.aspx
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10
14
Defining appropriate policies and procedures governing
employee behavior
Educating employees about the policies and procedures relevant
to them
Verifying employees’ understanding of relevant policies and
procedures
Discovering and addressing behavioral shortcomings
Managing change over time
Best Practices for Managing Human Risks
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company

24. www.jblearning.com
All rights reserved.
09/23/10
15
Summary
10 prevalent insider threats
User Domain access control management
Security awareness training
Best practices for managing human resources
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
09/23/10
16