Access Control, Authentication, and Public Key Infrastructure.docx

Access Control, Authentication, and Public Key Infrastructure
Lesson 5
Security Breaches and the Law
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Page ‹#›
Access Control, Authentication, and PKI
Company
www.jblearning.com
1
Laws and Data Breaches
Federal and state laws act as deterrents
Organizations are required to take steps to protect the sensitive
data
An organization may have a legal obligation to inform all
stakeholders
if a breach occurred
Page ‹#›
Company
www.jblearning.com

2
Federal Laws
Computer Fraud and Abuse Act (CFAA) designed to protect
electronic data from theft
Digital Millennium Copyright Act (DMCA) prohibits
unauthorized disclosure of data by circumventing an established
technological measure
Page ‹#›
Company
www.jblearning.com
The Computer Fraud and Abuse Act (CFAA)[1] was enacted by
Congress in 1986 as an amendment to existing computer fraud
law (18 U.S.C. § 1030), which had been included in the
Comprehensive Crime Control Act of 1984.
2008[1]
Eliminated the requirement that information must have been
stolen through an interstate or foreign communication, thereby
expanding jurisdiction for cases involving theft of information
from computers;
Eliminated the requirement that the defendant’s action must
result in a loss exceeding $5,000 and created a felony offense
where the damage affects ten or more computers, closing a gap
in the law;
Expanded 18 U.S.C. § 1030(a)(7) to criminalize not only
explicit threats to cause damage to a computer, but also threats
to (1) steal data on a victim's computer, (2) publicly disclose

stolen data, or (3) not repair damage the offender already
caused to the computer;
Created a criminal offense for conspiring to commit a computer
hacking offense under section 1030;
Broadened the definition of “protected computer” in 18 U.S.C. §
1030(e)(2) to the full extent of Congress’s commerce power by
including those computers used in or affecting interstate or
foreign commerce or communication; and
Provided a mechanism for civil and criminal forfeiture of
property used in or derived from section 1030 violations.
3
State Laws
California Identity Theft Statute requires businesses to notify
customers when personal information has been disclosed
Research specific laws that apply in your state.
You can begin by visiting your state’s
Office of Attorney General Web site.
Page ‹#›
Company
www.jblearning.com
Kentucky State Laws
On April 10, Governor Beshear signed into law H.B. 232,
designed to address the compromise of personally identifiable
information of residents of the Bluegrass State. The law also
requires cloud service providers that contract with educational
institutions (K-12) to maintain the security of student data
(name, address, email address, emails, and any documents,
photos or unique identifiers relating to the student) and
prohibits the sale or disclosure, or processing of student data

for commercial purposes.
Like most states, Kentucky has defined personally identifiable
information as first name or first initial and last name combined
with any of the following data elements when the name or data
element is not redacted:
Social Security number
Driver’s license number
Account number, credit or debit card number in combination
with any required security code, access code or password
permitting access to an individual’s financial account
Page ‹#›
Company
www.jblearning.com
First-Layer Access Controls
All physical security must comply with all applicable
regulations
Access to secure computing facilities granted only to
individuals with a legitimate business need for access.
All secure computing facilities that allow visitors must have an
access log.
Visitors must be escorted at all times
Page ‹#›
Company
www.jblearning.com

Most common and easiest form of access
To be effective: Requires the use of a secure channel through
the network to transmit the encrypted password
Not very secure
WHY USE THEM??
Something you know
User friendly – People get the concept (like an ATM pin #)
Two factor authentication
– Combine passwords with a (smart card) token
– ATM card and PIN –improved protection
Easy to manage
Supported across IT platforms
6
Access Control Failures
People
Technology
Page ‹#›
Company
www.jblearning.com

People
Social engineering
Phishing and spear phishing attacks
Poor physical security on systems
File-sharing and social networking sites
Page ‹#›
Company
www.jblearning.com
8
Technology
Very weak password encryption
Web browsers are a major vector for unauthorized access
Web servers and other public-facing systems, are an entry point
for unauthorized access
Page ‹#›
Company
www.jblearning.com
9
Privacy Impact Assessment (PIA)
A comprehensive process for determining the privacy,
confidentiality, and security risks associated with the
collection, use, and disclosure of personal information

Describes the measures used to mitigate and, if possible,
eliminate identified risks
Required in the public sector for any new system that handles
personally identifiable information (PII)
Page ‹#›
Company
www.jblearning.com
10
Privacy Impact Assessment (PIA) (Cont.)
Identifies the key factors involved in securing PII
Emphasizes the process used to secure PII as well as product
Has a sufficient degree of independence from the project
implementing the new system
Has a degree of public exposure
Is integrated into the decision-making process
Page ‹#›
Company
www.jblearning.com
11
Security Breach Principles
Page ‹#›

Company
www.jblearning.com
The difference between a direct & an indirect attack is in a
direct attack, the computer being used is that of the criminal to
commit a break-in of other computers/systems whereas an
indirect attack is where the actual computer or system being
attacked is compromised to completely this objective.
12
System exploits
Eavesdropping
Social engineering
Denial of service (DoS) attacks
Indirect attacks
Direct attacks

Consequences
Security breaches can have serious consequences for an
organization.
They can rely on:
Lax physical security
Inadequate logical access controls
A combination of both
Page ‹#›
Company
www.jblearning.com
13
Implications of Security Breaches
Page ‹#›
Company
www.jblearning.com
14

Damages organizations’ computer systems
Financial Impact
Legal action
Loss of reputation
Costs of contacting all of the individuals
Organization’s market share
Prevent or Mitigate Access Control Attacks
Example: Target
‹#›
Hackers originally gained access to Target’s network by
stealing the access credentials, via a phishing attack, of a

refrigeration contractor
Electronic interaction with Target was limited to billing,
contract submission, project management
Sophisticated and prolonged attack at Target
Once the hackers infiltrated the Target network, they distributed
malware to thousands of PoS machines designed to siphon off
customer data
The stolen data was later uploaded from the Target network to
an FTP server
Then, they set up a control server within Target’s internal
network that acted as the central repository for the stolen credit
card data
Example Discussion Activity
How could this attack have been prevented?
‹#›

Protecting the Enterprise
‹#›
Requires a coordinated defense involving people, processes and
tools that span anti-malware, firewalls, applications, servers,
network access controls, intrusion detection and prevention,
security event monitoring, and more
Identity and Access Management (IAM)
Obtain visibility and control over user access privileges, who
has access to what?
‹#›
Detective controls
Access policy
Automated account reconciliation
Authentication Attacks

‹#›
Occur when a web application authenticates users unsafely,
granting access to web clients that lack the appropriate
credentials
Access Control Attacks
‹#›
Occur when an access control check in the web application is
incorrect or missing, allowing users unauthorized access to
privileged resources such as databases and files
Web Applications
‹#›
Exposing these rich interfaces to anyone on the Internet makes
web applications an appealing target for attackers who want to
gain access to other users’ data or resources
Access Control

‹#›
Access control attacks attempt to bypass or circumvent access
control methods
Access control begins with identification and authorization
Access Aggregation
‹#›
Collecting multiple pieces of non-sensitive information and
combining, or aggregating, the pieces to learn sensitive
information
Reconnaissance Attacks
‹#›
Access aggregation attacks that combine multiple tools to
identify elements of a system, such as IP addresses, open ports,
running services, and operating systems

Protecting Against Access Control Attacks
‹#›
Control physical access to systems
Control electronic access to password files
Encrypt password files
Create a strong password policy
Use password masking
Deploy multifactor authentication
Use account lockout controls
Use last logon notification
Educate users about security
Audit access controls

Actively manage accounts
Use vulnerability scanners

Page ‹#›
Company
www.jblearning.com
Virtual Lab
Managing Group Policy Objects in Active Directory
Page ‹#›
Company
www.jblearning.com
If your educational institution included the Jones & Bartlett
labs as part of the course curriculum, use this script to introduce
the lab:
“In this lesson, you learned about ways that compromised
access controls can result in security breaches. You also
discovered the legal implications of security incidents. One
effective way to help prevent security breaches is to enforce
system logon security controls.
In the lab for this lesson, you will use the Group Policy
Management tool to edit the default domain policy and set up a
new password policy. You will also create a new group policy
object (GPO) and apply it to an organizational unit."
6/7/2016
28

1
Running head: TITLE OF YOUR PAPER (50 characters max)
4
TITLE OF YOUR PAPER
Title of Your Paper
Your Name
Independence University
Abstract
An abstract is optional and is a general overview of the content
covered in your paper. The abstract should be no more than 250
words. In general class assignments, the abstract may not be
required. Please check with you instructor regarding this
requirement. For the running head above, the words Running
head: should be in the same 12-point font as the rest of the
paper, only appear on the cover page, be on the same line as the
page number, and be aligned with the left 1” margin. The paper
title portion should be in all caps. For the second page and
beyond, the running head should only include the paper title in
all caps. The page numbers should be aligned at the right 1”
margin.

Title of Your Paper
The initial paragraph is assumed in APA to include the
introduction to your paper, and therefore does not require the
heading of “Introduction”. Use the paper title as the initial
paper heading, centered, not in bold, with major words
capitalized. The heading and content should start at the top of
the page with no extra spacing. The entire paper should be
double-spaced with no extra spacing between headings or
paragraphs. The first line of every paragraph should be indented
5-7 spaces, or .5” by default. This includes paragraphs
following numbered lists and images. This section should
“introduce” the reader to the content covered in your paper. In
many ways, the introduction serves as a mini-outline for the rest
of the paper. So, as you continue to write the remaining
sections, make sure to only include the information related to
what you have “introduced” in your introduction paragraph. To
sum it up, this section should tell the audience what you are
going to talk about in the Body.
Body
Use a level 1 APA heading appropriate for the content to
introduce this section, centered and in bold. Do not use the
Body heading. The “body” of your paper should expand on the
concepts covered in your introduction. It is appropriate to have
main and subtopics in this section. The main and subtopics
should be identified by using the appropriate Level Heading.
To sum it up, this section should talk about what you told the

audience you were going to talk about in your Introduction. Use
additional APA heading levels following an outline format for
each new concept section in your paper. Level 1 is centered and
in bold. Level 2 is left-aligned and in bold, level 3 is in the first
line of the paragraph, in bold, and ending with a period., etc.
Each heading should be appropriate for the content contained in
the paragraphs under the heading.
Citing Your Sources
When using information from outside sources in your writing,
you must cite those sources appropriately. As an example, if
you are paraphrasing, follow the end of the information with a
citation, then follow with the period to end the sentence. The
citation must include the author and year, like this (Lodico,
Spaulding & Voegtle, 2010). The citations must match the
references provided at the end of the paper. Only provide the
author’s initials in the full references at the end of the paper,
not within the citations. A quote would be followed with a
citation containing the page or paragraph number for the quoted
content. An example would be, “This is a hypothetical quote”
(Scaduto, Lindsay, & Chiaburu, 2008, p. 27). If you introduce
the authors in your sentence, immediately follow their names
with the year in parentheses. For example, Lodico, Spaulding
and Voegtle (2010) wrote a paper discussing educational
research methods.
Conclusion
This section should cover the highlights of the previous
content. The conclusion should “briefly” remind your
reader/audience about what is included in the previous sections.
Refrain from introducing new topics or ideas in this section,
unless you want to revisit and rework/rewrite previous sections
to include them. To sum it up, this section is going to remind
your audience of what you just told them in the Body, while
making a final point. Once you have completed this section, you
need to complete the References page. An outline of the
Reference page is below.

References
Lodico, M.G., Spaulding, D.T., & Voegtle, K.H. (2010).
Methods in educational research: From theory to practice. San
Francisco, CA: Jossey-Bass.
Scaduto, A., Lindsay, D., Chiaburu, D.S. (2008). Leader
influences on training effectiveness: motivation and outcome
expectation processes. International Journal of Training and
Development, 12(3), 158-170.
This is where all the references you used will be listed
alphabetically by author’s last name. The reference page needs
to be double-spaced and the second line of the same reference
should be added as a “hanging” indent. All references should
also be double-spaced with no extra spacing between them. All
references should be in the same font as the rest of the paper.
The content of this page should begin at the top of the page with
no extra spacing. Once you have added your references, please
delete this section and the information below from the template.
Additional APA resources are below:
Purdue Online Writing Lab APA
Son of Citation Machine APA
How to cite and reference just about any type of source, with
examples
APA 6 writing instructions and example

Access Control, Authentication, and Public Key Infrastructure.docx

Recommended

Recommended

More Related Content

Similar to Access Control, Authentication, and Public Key Infrastructure.docx

Similar to Access Control, Authentication, and Public Key Infrastructure.docx (20)

More from nettletondevon

More from nettletondevon (20)

Recently uploaded

Recently uploaded (20)

Access Control, Authentication, and Public Key Infrastructure.docx