CISSP Domain 5 - Access Control Overview MindMap

Introduction

Hey, I’m Rob Witcher from Destination Certification, and I’m here to help YOU pass the CISSP exam. We are going to go through a review of the major topics related to Access Control in Domain 5, to understand how they interrelate, and to guide your studies.

This is the first of two videos for domain 5. I have included links to the other MindMap videos in the description below. These MindMaps are one part of our complete CISSP MasterClass.

Access Control

Access controls are the collection of mechanisms that work together to protect the assets of an organization. These access controls can be both physical controls, like locks, and logical controls, such as a login mechanism to access an operating system.

Access controls enable management to:

• Specify which users
• Can access what resources
• What operations they can perform
• And provide individual accountability

Access Control Principles

Separation of Duties

Need to Know

Least Privilege

Administration Approaches

Centralized

In a centralized approach, access to multiple separate applications is managed through one centralized system.

Decentralized

In a decentralized approach, access to multiple applications is managed individually within each application.

Hybrid

Many organizations used a hybrid approach, which is simply some combination of centralized and decentralized.

Access Controls Services

Now let’s talk about the access controls services. There are 4 major services that all access control system must provide: Identification, Authentication, Authorization, and Accountability.

Identification

We’ll start with identification. This is where the user must assert their identity to the system. For example, my username is rwitcher.

Authentication

Authentication is where the system verifies the user’s identity via one of the three factors of authentication: knowledge, ownership, or characteristic

Knowledge

Authentication by knowledge, also referred to as something you know, is where a user verifies their identity by providing some information that they have memorized

Password

It could be a password.

Passphrase

Or a Passphrase. A long sequence of words that are easy to remember

Questions

Ownership

The second factor of Authentication is ownership, also referred to as something you have. Authentication by Ownership are things that we have in our possession

One-time Passwords

The most common form of authentication by ownership is one-time passwords. We call them one-time passwords because they are only meant to be used once.

Hard Tokens

Hard tokens are dedicated pieces of hardware that generate the one-time passwords. Such as an RSA ID key

Soft Tokens

Synchronous

There are two types of hard or soft tokens, Synchronous and Asynchronous.
In a Synchronous system, both the hard or soft token, and the authentication server are generating the same one-time password every 30 to 60 seconds. They are synchronized.

Asynchronous

Asynchronous involves a challenge and a response. To authenticate, the user is sent a challenge, which they enter into their hard or soft token device, and a response is generated – the one-time-password. Asynchronous systems are rare, as they are more expensive and complicated, but they are more secure. So in high value situations, like say Bloomberg Financial terminals, they are used.

Smart / Memory Cards

Characteristic

Authentication by characteristic. The reason we call it characteristic and not just biometrics is that there are two main characteristics that we can look at for authentication, physiological and behavioral characteristics.

Physiological

Physiological characteristics are what make up our physiology, our bodies, and are therefore often referred to as biometrics.

Fingerprint

It’s pretty obvious what most of these physiological characteristics are looking at, our fingerprints

Hand Geometry

Hand geometry is looking at the overall dimensions of our hands

Vascular Pattern

Vascular pattern scanners are looking at our vein patterns; often on the back of our hands. When you take the CISSP exam, you are likely to encounter a vascular scanner as many of the pearsonVue testing centers use them as part of registering you to take the exam. They want to make sure that if you step out during the exam to take a break, that it is you coming back into the room and not someone you have hired to write a test for you.

Facial

Facial scanners look at our faces

Iris

Iris scanners look at the coloured ring of our eye. The outside of our eyeball

Retina

Retinal scanners on the other hand look at the vein pattern on the back of our eyeballs. The inside of our eyeball. Retinal scanners are typically considered to be the most accurate of the biometric systems.

Behavioral

Behavioral characteristics are how we act, how we do certain things, like speak, type, and walk

Voice

Voice systems analyze the way we speak, the minutiae of our voices

Signature

Signature systems look at how we write. How we sign our name for example

Key Stroke

Keystroke dynamics systems look at how we type. Characteristics such as dwell and flight time

Gait

And gait dynamics looks at how we walk.

Templates

When a biometric system collects a sample for a user, for example their fingerprint scan, facial scan, etc. the data will be processed to look for unique characteristics and a mathematical representation of the user's unique biometric data will be created. This unique mathematical representation is called a biometric template. Templates can be used in a couple of major ways: in 1 to N (1 to Many) lookup for Identification, and in a 1 to 1 direct comparison for Authentication.

Type 1: False Reject

A challenging aspect of biometric systems for authentication is that they are not binary, and by that I mean they are not 100% sure that it is a valid user and not 100% sure it is an invalid user trying to authenticate. As such we have to deal with two types of errors related to biometric systems. The first is a Type 1: False Reject. This is where a valid user is falsely rejected.

Type 2: False Accept

A type 2: False accept is the inverse. This is where an invalid user, say an attacker, is falsely authenticated and given access. Not Good!

Crossover Error Rate

The final piece here related to authentication by characteristic is the CrossOver Error rate. Type 1 and Type 2 errors are inverse to each other. If you graph them, you would see that the line for Type 1 errors will intersect the Line for Type 2 errors, and where they intersect is the aptly named CrossOver Error rate or Equal Error Rate (EER). The Crossover Error Rate is a good measure of the overall accuracy of a biometric system.

Single / Multifactor

We have now discussed the 3 factors of authentication: Knowledge, Ownership and Characteristics. Single Factor authentication is simply one of these factors. Multi-factor authentication means using two or more DIFFERENT factors of authentication.

Authenticator Assurance Levels (AAL)

The Authenticator Assurance Levels is a model for measuring the robustness, the security, of an authentication process. There are 3 levels: AAL 1 is the least secure, and AAL3 is the most secure.

Just-in-time Access

Just-In-Time (JIT) Access is an access control strategy where user access to a system is granted exactly when needed, and only for the duration required to complete a specific task. Essentially, instead of having constant access at all times, users are granted permissions dynamically when they need to use them, and these permissions are revoked once a task is completed. Very cool idea.

Authorization

Now let’s talk about authorization, this is where we define a user’s specific access within a system, what they are authorized to access, and this is where we apply principles like least privilege and need to know.

Discretionary

The first access control philosophy is known as Discretionary Access and the defining characteristic of discretionary access is that the owner of the system is deciding who is authorized to access what. This is a very good security practice as owners best understand their systems, and are accountable for the security of their systems.

Rule

Within discretionary access we have Rule based, just a list of rules in a file, or an ACL, access control list

Role

Role based access, where we create roles, define the access for those roles, and then assign one or more roles to a user. The roles assigned to a user define a user’s access.

Types of RBAC

There are four major types of RBAC that you should be familiar with.
Non-RBAC means there is no roles based access.

Limited-RBAC means within specific applications you can create roles and the role within an application will only define a user’s access in that specific application

Hybrd-RBAC is where you get to the point where you can create role, and through that role you can define a user’s access in multiple different applications. But not every application across the organization is integrated into the role based access system

Which brings us to Full-RBAC. Full-RBAC means through a role you could grant a user access to any application across the organization. Most companies don’t get to Full-RBAC and instead use Limited or Hybrid-RBAC.

Attribute / Context

And attribute-based access, sometimes referred to as context based. Where we look at a series of different attributes to make an authorization decision: source IP address, geo location, OS type, classification of asset being accessed, etc.

Non-discretionary

The next access control philosophy is known as Non-Discretionary. Discretionary means the owner decides. So non-discretionary means someone other than the owner decides who is authorized to access what – like an IT helpdesk person. This is not a good security practice.

Mandatory

The last and final access control philosophy is known as Mandatory. Mandatory means the system decides. Based on the security clearance of users and the classification of assets. Labeling is an important requirement for Mandatory access.

Accountability

The final and most important access control service is Accountability. To have security, we must ensure users are accountable for their actions on a system.

Principle of Access Control

Because accountability is the most important access control service, we give it a special name: the principle of Access Control. So, remember, the principle of access control is accountability and accountability is the principle of access control.

Session Management

The Final piece here is session management. Whenever a user has identified themselves, been authenticated and authorized into a system, this begins a session. Session management is all about managing these sessions to ensure they are secure.

Session Hijacking

The major risk we are concerned with related to sessions is session hijacking.

And that is an overview of Access Control within Domain 5, covering the most critical concepts you need to know for the exam.

As you’re no doubt seeing as you go through these MindMap videos, there is an immense amount of information across a huge number of topics that you need to know to pass the CISSP exam.

A huge challenge most people like yourself face is figuring out what they need to focus on. What exactly do you already know, and what do you need to focus on in your studies.

This is a problem that we have solved for our students. Our CISSP MasterClass will automatically build an extremely detailed personalized guide for you that will show you exactly what you need to focus on in your studies, and even better, all of the extensive super high-quality study materials we have built are instantly accessible to you.

We show you exactly what you need to study and provide all the study materials you need to confidently pass the CISSP exam.

You can learn more about our CISSP MasterClass here: destcert.com/CISSP

Link in the description below as well.

If you found this video helpful you can hit the thumbs up button and if you want to be notified when we release additional videos in this MindMap series, then please subscribe and hit the bell icon to get notifications.

I will provide links to the other MindMap videos in the description below.

Thanks very much for watching! And all the best in your studies!