book

Access Control and Identity Management, 3rd Edition

Name: Access Control and Identity Management, 3rd Edition
Author: Mike Chapple
ISBN: 9781284198362

by Mike Chapple

October 2020

Intermediate to advanced

376 pages

13h 58m

English

Jones & Bartlett Learning

Read now

Unlock full access

Cover
Title Page
Copyright Page
Contents
Preface
Acknowledgments
About the Author
Dedication
CHAPTER 1 Access Control Framework
Access and Access Control
What Is Access?What Is Access Control?What Is Identity Management?

Principal Components of Access Control
Access Control SystemsAccess Control SubjectsAccess Control Objects
Access Control Process
IdentificationAuthenticationAuthorization
Logical Access Controls
Logical Access Controls for Subjects
Group-Based Access ControlsLogical Access Controls for Objects
Authentication Factors
Something You KnowSomething You HaveSomething You Are
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 1 ASSESSMENT
CHAPTER 2 Business Drivers for Access Controls
Business Requirements for Asset Protection
Importance of PolicySenior Management Role
Classification of Information
Classification SchemesPersonally Identifiable Information (PII)Privacy Act InformationPrivacy Controls Catalog
Competitive Use of Information
Valuation of Information
The Business Drivers for Access Control
Cost-Benefit AnalysisRisk AssessmentBusiness FacilitationCost ContainmentOperational EfficiencyIT Risk Management
Controlling Access and Protecting Value
Importance of Internal Access ControlsImportance of External Access Controls
Case Studies and Examples
Case Study in Access Control SuccessCase Study in Access Control Failure
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 2 ASSESSMENT
CHAPTER 3 Human Nature and Organizational Behavior
The Human Element
Dealing with Human NatureSocial EngineeringPre-Employment Background Checks for Sensitive PositionsOngoing Observation of Personnel
Organizational Structure and Access Control Strategy
Job Rotation and Position Sensitivity
Requirement for Periodic Vacation
Separation of Duties
Concept of Two-Person ControlCollusionMonitoring and Oversight
Responsibilities of Access Owners
Training Employees
Acceptable Use PolicySecurity Awareness Policy
Ethics
What Is Right and What Is WrongEnforcing PoliciesHuman Resources Involvement
Best Practices for Handling Human Nature and Organizational Behavior
Make Security Practices Common KnowledgeFoster a Culture of Open DiscussionEncourage Creative Risk-Taking
Case Studies and Examples
Private Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case Study
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 3 ASSESSMENT
CHAPTER 4 Assessing Risk and Its Impact on Access Control
Definitions and Concepts
Threats and Vulnerabilities
Access Control ThreatsAccess Control Vulnerabilities
Risk Assessment
Quantitative Risk AssessmentQualitative Risk AssessmentRisk Management Strategies
Value, Situation, and Liability
Potential Liability and Nonfinancial ImpactWhere Are Access Controls Needed Most?How Secure Must the Access Control Be?
Case Studies and Examples
Private-Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case Study
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 4 ASSESSMENT
CHAPTER 5 Access Control in the Enterprise
Access Control Lists (ACLs) and Access Control Entries (ACEs)
Access Control Models
Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC)Attribute-Based Access Control (ABAC)Rule-Based Access Control (RuBAC)Risk-Adaptive Access Control (RAdAC)Authentication FactorsTypes of FactorsFactor Usage CriteriaHow Does Kerberos Authentication Work?Use of Symmetric Key and Trusted Third Parties for AuthenticationKey Distribution Center (KDC)Authentication TicketsPotential WeaknessesKerberos in a Business Environment
Network Access Control
Layer 2 TechniquesLayer 3 TechniquesCEO/CIO/CSO Emergency Disconnect Prime Directive
Wireless IEEE 802.11 LANs
Access Control to IEEE 802.11 WLANsIdentificationConfidentialityAuthorization
Single Sign-On (SSO)
Defining the Scope for SSOConfiguring User and Role-Based User Access Control ProfilesCommon ConfigurationsEnterprise SSO
Best Practices for Handling Access Controls in an Enterprise Organization
Case Studies and Examples
Private Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case Study
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 5 ASSESSMENT
CHAPTER 6 Mapping Business Challenges to Access Control Types
Access Controls to Meet Business Needs
Business Continuity and Disaster RecoveryRisk and Risk MitigationThreats and Threat MitigationVulnerabilities and Vulnerability Management
Solving Business Challenges with Access Control Strategies
Employees with Access to Systems and DataEmployees with Access to Sensitive Systems and DataAdministrative StrategiesTechnical StrategiesSeparation of PrivilegesLeast PrivilegeNeed to KnowInput/Output Controls
Access Control System Design Principles
Case Studies and Examples
Private Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case Study
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 6 ASSESSMENT
CHAPTER 7 Access Control System Implementations
Transforming Access Control Policies and Standards into Procedures and Guidelines
Transform Policy Definitions into Implementation TasksFollow Standards Where ApplicableCreate Simple and Easy-to-Follow ProceduresDefine Guidelines That Departments and Business Units Can Follow
Identity Management and Access Control
User Behavior, Application, and Network Analysis
Size and Distribution of Staff and Assets
Multilayered Access Control Implementations
User Access Control ProfilesSystem Access Control ListsApplications AccessFile and Folder AccessData Access
Access Controls for Employees, Remote Employees, Customers, and Business Partners
Remote Virtual Private Network (VPN) Access—Remote Employees and WorkersIntranets—Internal Business Operations and CommunicationsExtranets—External Supply Chains, Business Partners, Distributors, and ResellersSecure E-Commerce Sites with EncryptionSecure Online Banking Access Control ImplementationsLogon/Password AccessIdentification Imaging and Authorization
Federated Identities and Third Party Identity Services
Best Practices for Access Control Implementations
Case Studies and Examples
Private Sector Case StudyPublic Sector ExampleCritical Infrastructure Case Study
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 7 ASSESSMENT
CHAPTER 8 Access Control for Information Systems
Access Control for Data
Data at RestData in MotionObject-Level Security
Access Control for File Systems
Access Control ListDiscretionary Access Control ListSystem Access Control List
Access Control for Executables
Delegated Access Rights
Microsoft Windows Workstations and Servers
Granting Windows Folder PermissionsDomain Administrator RightsSuper Administrator RightsPass-the-Hash Attacks
Linux
Linux File PermissionsThe Root Superuser
Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems
Best Practices for Access Controls for Information Systems
Case Studies and Examples
Private Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case Study
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 8 ASSESSMENT
CHAPTER 9 Physical Security and Access Control
Physical Security
Designing a Comprehensive Plan
Building Security and AccessPoints of Entry and ExitPhysical Obstacles and BarriersGranting Access to Physical Areas Within a Building
Biometric Access Control Systems
Principles of OperationTypes of Biometric SystemsImplementation IssuesModes of OperationBiometric System ParametersLegal and Business Issues
Technology-Related Access Control Solutions
Physical LocksElectronic Key Management System (EKMS)Fobs and TokensCommon Access Cards
Outsourcing Physical Security—Pros and Cons
Benefits of Outsourcing Physical SecurityRisks Associated with Outsourcing Physical Security
Best Practices for Physical Access Controls
Case Studies and Examples
Private Sector Case Study and ExamplePublic Sector Case StudyCritical Infrastructure Case Study
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 9 ASSESSMENT
CHAPTER 10 Access Control Solutions for Remote Workers
Growth in Mobile Work Force
Remote Access Methods and Techniques
IdentificationAuthenticationAuthorization
Access Protocols to Minimize Risk
Authentication, Authorization, and Accounting (AAA)Remote Authentication Dial in User Service (RADIUS)Remote Access Server (RAS)TACACS, XTACACS, and TACACS+Differences Between RADIUS and TACACS+
Remote Authentication Protocols
Network Authentication Protocols
Virtual Private Networks (VPNs)
Web Authentication
Knowledge-Based Authentication (KBA)
Best Practices for Remote Access Controls to Support Remote Workers
Case Studies and Examples
Private Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case Study
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 10 ASSESSMENT
CHAPTER 11 Public Key Infrastructure and Encryption
Public Key Infrastructure (PKI)
What Is PKI?Encryption and CryptographyBusiness Requirements for CryptographyDigital Certificates and Key ManagementSymmetric Versus Asymmetric AlgorithmsCertificate Authority (CA)
Ensuring Integrity, Confidentiality, Authentication, and Nonrepudiation
Use of Digital Signatures
What PKI Is and What It Is Not
What Are the Potential Risks Associated with PKI?
Implementations of Business Cryptography
DistributionIn-House Key Management Versus Outsourced Key Management
Certificate Authorities (CAs) and Digital Certificate Management
Why Outsourcing a CA May Be AdvantageousRisks and Issues with Outsourcing a CA
Best Practices for PKI Use Within Large Enterprises and Organizations
Case Studies and Examples
Private Sector Case StudyPublic Sector Case StudyCritical Infrastructure Example
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 11 ASSESSMENT
CHAPTER 12 Testing Access Control Systems
Purpose of Testing Access Control Systems
Software Development Life Cycle and the Need for Testing Software
PlanningRequirements AnalysisSoftware DesignDevelopmentTesting and IntegrationRelease and TrainingSupport
Security Development Life Cycle and the Need for Testing Security Systems
InitiationAcquisition and DevelopmentImplementation and TestingOperations and MaintenanceSunset or Disposal
Security Monitoring, Incident Handling, and Testing
Requirement Definition—Testing the Functionality of the Original DesignDevelopment of Test Plan and ScopeSelection of Penetration Testing Teams
Performing the Access Control System Penetration Test
Assess if Access Control System Policies and Standards Are FollowedAssess if the Security Baseline Definition Is Being Achieved ThroughoutAssess if Security Countermeasures and Access Control Systems Are Implemented Properly
Preparing the Final Test Report
Identify Gaps and Risk Exposures and Assess ImpactDevelop Remediation Plans for Closing Identified Security Gaps Prioritized by Risk ExposurePrepare Cost Magnitude Estimate and Prioritize Security Solutions Based on Risk Exposure
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 12 ASSESSMENT
CHAPTER 13 Access Control Assurance
What Is Information Assurance?
C-I-A TriadThe Five PillarsThe Parkerian Hexad
How Can Information Assurance Be Applied to Access Control Systems?
Access Controls Enforce ConfidentialityAccess Controls Enforce IntegrityAccess Controls Enforce AvailabilityTraining and Information Assurance Awareness
What Are the Goals of Access Control System Monitoring and Reporting?
What Checks and Balances Can Be Implemented?
Track and Monitor Event-Type Audit LogsTrack and Monitor User-Type Audit LogsTrack and Monitor Unauthorized Access Attempts Audit Logs
Audit Trail and Audit Log Management and Parsing
Audit Trail and Audit Log Reporting Issues and Concerns
Security Information and Event Management (SIEM)
Best Practices for Performing Ongoing Access Control System Assurance
Case Studies and Examples
Private Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case Study
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 13 ASSESSMENT
CHAPTER 14 Access Control Laws, Policies, and Standards
U.S. Compliance Laws and Regulations
Gramm-Leach-Bliley Act (GLBA)Health Insurance Portability and Accountability Act (HIPAA)Sarbanes-Oxley (SOX) ActFamily Educational Rights and Privacy Act (FERPA)Communications Assistance for Law Enforcement Act (CALEA)Children’s Internet Protection Act (CIPA)Food and Drug Administration (FDA) RegulationsNorth American Electric Reliability Council (NERC)Homeland Security Presidential Directive 12 (HSPD 12)Americans with Disabilities Act (ADA)
Access Control Security Policy Best Practices
Private Sector—Enterprise OrganizationsPublic Sector—Federal, State, County, and City GovernmentCritical Infrastructure, Including Utilities and Transportation
IT Security Policy Framework
Which Policies Are Needed for Access Controls?What Standards Are Needed to Support These Policies?Which Procedures Are Needed to Implement These Policies?What Guidelines Are Needed for Departments and End Users?
Case Studies and Examples
Private Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case Study
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 14 ASSESSMENTENDNOTE
CHAPTER 15 Security Breaches and the Law
Laws to Deter Information Theft
U.S. Federal LawsState Laws
Cost of Inadequate Front-Door and First-Layer Access Controls
Access Control Failures
PeopleTechnology
Security Breaches
Kinds of Security BreachesWhy Security Breaches OccurImplications of Security Breaches
Case Studies and Examples
Private Sector Case StudiesPublic Sector Case StudyCritical Infrastructure Case Study
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 15 ASSESSMENT
Appendix A Answer Key
Appendix B Standard Acronyms
Glossary of Key Terms
References
Index

Content preview from Access Control and Identity Management, 3rd Edition

Case Studies and Examples

Security breaches can have serious consequences for an organization. They can rely on lax physical security, inadequate logical access controls, or a combination of both. In this section, we look at case studies of breaches that occurred in the private sector, the public sector, and in critical infrastructure applications.

Private Sector Case Studies

The following case studies highlight examples of failures in both logical access controls and physical security.

LexisNexis

LexisNexis is a major information clearinghouse of newspaper, magazine, and legal documents. Customers can search the system for basically any published information. In early 2005, a number of teenage hackers were able to gain access to the ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781284198362

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills