book

Access Control, Authentication, and Public Key Infrastructure

by Bill Ballad, Tricia Ballad, Erin Banks

October 2010

Intermediate to advanced

398 pages

12h 17m

English

Jones & Bartlett Learning

Read now

Unlock full access

Copyright
Preface
Purpose of This BookLearning FeaturesAudience
Acknowledgments
ONE. The Need for Access Control Systems
1. Access Control Framework
Access and Access ControlWhat Is Access?What Is Access Control?Principal Components of Access ControlAccess Control SystemsAccess Control SubjectsAccess Control ObjectsAccess Control ProcessIdentificationAuthenticationAuthorizationLogical Access ControlsLogical Access Controls for SubjectsWhoWhatWhenWhereHowGroup Access ControlsLogical Access Controls for ObjectsAuthentication FactorsSomething You KnowSomething You HaveSomething You AreCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 1 ASSESSMENT
2. Assessing Risk and Its Impact on Access Control
Definitions and ConceptsThreats and VulnerabilitiesAccess Control ThreatsPassword CrackingHeightened AccessSocial EngineeringAccess Control VulnerabilitiesAssessing the Impact of Threats and VulnerabilitiesConsiderations for Designing a Risk AssessmentValue, Situation, and LiabilityPotential Liability and Non-Financial ImpactWhere Are Access Controls Needed Most?How Secure Must the Access Control Be?The Utility of Multilayered Access Control SystemsUser DomainWorkstation DomainLAN DomainLAN-to-WAN DomainWAN DomainRemote Access DomainSystem/Application DomainExamining a Multilayered ApproachCase Studies and ExamplesPrivate SectorPublic SectorCritical InfrastructureCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 2 ASSESSMENT
3. Business Drivers for Access Controls
Business Requirements for Asset ProtectionImportance of PolicySenior Management RoleClassification of InformationClassification SchemesNational Security ClassificationCorporationsReasons for ClassificationDeclassification Process and PolicyPersonally Identifiable Information (PII)Privacy Act InformationCompetitive Use of InformationWarfare as a Model for BusinessSun TzuClausewitzCase study.Valuation of InformationAs a Competitive AdvantageCase study.As Penalties for Improper DisclosureBusiness DriversCost-Benefit AnalysisAdvantage GainedRisk AvoidedRisk AssessmentBusiness FacilitationAccess LevelsUnderstanding access levels: A newsletter example.Understanding access levels: An order process example.Restricting AccessCost ContainmentOperational EfficiencyThe Right InformationThe Right PeopleThe Right TimeIT Risk ManagementFull Asset InventoryVulnerability AssessmentThreat AssessmentMitigation PlansRisk Assessment PoliciesCompliance—Laws, Regulations, and AgreementsControlling Access and Protecting ValueImportance of Internal Access ControlsImportance of External Access ControlsImplementation of Access Controls with Respect to Contractors, Vendors, and Third PartiesAccess Controls with Respect to ContractorsAccess Controls with Respect to VendorsAccess Controls with Respect to Other Third PartiesExamples of Access Control Successes and Failures in BusinessCase Study in Access Control SuccessCase Study in Access Control FailureCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 3 ASSESSMENTENDNOTES
4. Access Control Policies, Standards, Procedures, and Guidelines
U.S. Compliance Laws and RegulationsGramm-Leach-Bliley Act (GLBA)RequirementsGLBA and Access ControlHealth Insurance Portability and Accountability Act (HIPAA)Privacy RuleTransactions and Codes Set RuleUnique Identifier Standards RuleSecurity RuleEnforcement RuleSarbanes-Oxley (SOX) ActFamily Educational Rights and Privacy Act (FERPA)Children's Internet Protection Act (CIPA)21 CFR Part 11North American Electric Reliability Council (NERC)Homeland Security Presidential Directive 12 (HSPD 12)Part 1Part 2Access Control Security Policy Best PracticesPrivate Sector—Enterprise OrganizationsDefining an Authorization PolicyAccess Control for FacilitiesAccess Control for SystemsAccess Control for ApplicationsAccess Control for DataAccess Control for Remote AccessPublic Sector—Federal, State, County, and City GovernmentCritical Infrastructure, Including Utilities and TransportationSupervisory Control and Data Acquisition (SCADA) Process Control SystemsThreats and VulnerabilitiesIT Security Policy FrameworkWhat Policies Are Needed for Access Controls?What Standards Are Needed to Support These Policies?What Procedures Are Needed to Implement These Policies?What Guidelines Are Needed for Departments and End Users?Examples of Access Control Policies, Standards Procedures, and GuidelinesPrivate Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case StudyCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 4 ASSESSMENTENDNOTE
5. Unauthorized Access and Security Breaches
Deterring Information TheftU.S. Federal LawsComputer Fraud and Abuse Act (CFAA)Digital Millennium Copyright ActState LawsCost of Inadequate Front-Door and First-Layer Access ControlsAccess Control FailuresPeopleRogue Internal OperativesOther People-Related ThreatsTechnologyAccess Control and Privacy AssessmentsStructure of a PIA.Security BreachesKinds of Security BreachesWhy Security Breaches OccurImplications of Security BreachesThe Impact of a Security Breach Can Be SignificantFinancial Impact of Security BreachesMonster.com security breach.TJX security breach.Private Sector Case StudiesLexisNexisBank OnePublic Sector Case StudyCritical Infrastructure Case StudyCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 5 ASSESSMENT
TWO. Mitigating Risk with Access Control Systems, Authentication, and PKI

6. Mapping Business Challenges to Access Control Types
Mapping Business Challenges to Types of ControlBusiness ContinuityDisaster PreventionWhen physical and administrative controls fail.Disaster RecoveryCustomer Access to DataMaintain Competitive AdvantageRisk and Risk MitigationRisk AvoidanceRisk AcceptanceRisk TransferenceRisk MitigationThreats and Threat MitigationVulnerabilities and Vulnerability ManagementSolving Business Challenges with Access Control StrategiesEmployees with Access to Systems and DataWho Needs Access to Which Resources?Creating Groups and RolesExternal Access to Systems and DataEmployees with Access to Sensitive Systems and DataAdministrative StrategiesTechnical StrategiesSeparation of ResponsibilitiesLeast PrivilegeRisks Associated with Users Having Administrative RightsCommon RolesAdministrator.User.Guest.Need to KnowInput/Output ControlsInput ControlsOutput ControlsCase Studies and Examples of Access Control Systems That Uniquely Solve Business ChallengesPrivate Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case StudyCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 6 ASSESSMENT
7. Human Nature and Organizational Behavior
The Human ElementDealing with Human NatureThe Unintentional ThreatHackers and MotivationSocial EngineeringPre-Employment Background Checks for Sensitive PositionsWhat Information Can Be Considered in an Employment DecisionWhat Information Cannot be Considered in an Employment DecisionApplicant's RightsConsequences of a Bad Hiring DecisionOngoing Observation of PersonnelIdentify Potentially Disgruntled EmployeesProper Way to Terminate Access upon Termination of EmploymentOrganizational StructureJob Rotation and Position SensitivityRequirement for Periodic VacationSeparation of DutiesConcept of Two-Person ControlCollusionMonitoring and OversightResponsibilities of Access OwnersTraining EmployeesAcceptable Use PolicySecurity Awareness PolicyEthicsWhat Is Right and What Is WrongEthics Go Beyond "Do Not Steal"Enforcing PoliciesHuman Resources InvolvementBest Practices for Handling Human Nature and Organizational BehaviorMake Security Practices Common KnowledgeFoster a Culture of Open DiscussionEncourage Creative Risk-TakingCase Studies and Examples of Access Control Systems That Uniquely Solve Business ChallengesPrivate Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case StudyCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 7 ASSESSMENT
8. Access Control for Information Systems
Access Control for DataData at RestSecuring DARData in MotionSecuring DIMObject-Level SecurityAccess Control for File SystemsAccess Control ListDiscretionary Access Control ListSystem Access Control ListAccess Control for ExecutablesDelegated Access RightsMicrosoft Windows Workstations and ServersDomain Administrator RightsSuper Administrator RightsUNIX and LinuxUNIX and Linux File PermissionsLinux Intrusion Detection System (LIDS)The Root SuperuserNetwork Information Service (NIS) and NIS+Supervisory Control and Data Acquisition (SCADA) and Process Control SystemsBest Practices for Access Controls for Information SystemsCase Studies and Examples of Access Control Solutions That Uniquely Solve Business ChallengesPrivate Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case StudyCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 8 ASSESSMENT
9. Physical Security and Access Control
Physical SecurityDesigning a Comprehensive PlanBuilding Security and AccessPoints of Entry and ExitPhysical Obstacles and BarriersGranting Access to Physical Areas Within a BuildingGeneric Work AreasSensitive Work AreasClassified Government FacilitiesComputer Rooms and Data CentersBiometric Access Control SystemsPrinciples of OperationTypes of Biometric SystemsPhysiological TypesFingerprint.retina.Iris.Hand geometry.Facial recognition.Behavioral TypesTyping tempo.Signature analysis.Voice recognition.Implementation IssuesFalse Acceptance RateFalse Rejection RateCrossover Error RateFailure to Enroll RateFailure to Capture RateModes of OperationVerificationIdentificationParametersUniversalityUniquenessPermanenceCollectabilityPerformanceAcceptabilityCircumventionLegal and Business IssuesPrivacy ConcernsCost-Effectiveness of Biometric SolutionCost of Deployment and MaintenanceDatabase Storage and TransmissionLaw Enforcement DatabasesPersonal Danger IssuesTechnology-Related Access Control SolutionsTraditionalElectronic Key Management System (EKMS)Fobs and TokensCommon Access Cards (CAC)Outsourcing Physical Security—Pros and ConsBenefits of Outsourcing Physical SecurityRisks Associated with Outsourcing Physical SecurityBest Practices for Physical Access ControlsCase Studies and Examples of Physical Security and Access Control Systems That Uniquely Solve Business ChallengesPrivate Sector—Case Studies and ExamplesPublic Sector Case StudyCritical Infrastructure Case StudyCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 9 ASSESSMENT
10. Access Control in the Enterprise
Access Control Lists (ACLs) and Access Control Entries (ACEs)Access Control ModelsDiscretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC)Attribute-Based Access Control (ABAC)Authentication FactorsTypes of FactorsSomething You KnowWeaknesses of knowledge-based methodologies.Something You HaveSmart card.Time-variable token.Challenge-response device.Something You ArePhysiological-based biometrics.Behavior-based biometrics.Factor Usage CriteriaSingle-Factor AuthenticationTwo-Factor AuthenticationThree-Factor AuthenticationKerberosHow Does Kerberos Authentication Work?Use of Symmetric Key and Trusted Third Parties for AuthenticationKey Distribution Center (KDC)Authentication TicketsPrincipal Weaknesses in ImplementationWhen Appropriate for Business UseNetwork Access ControlLayer 2 TechniquesMAC Address Database for LAN SwitchesDefining Broadcast DomainsIEEE 802.1q Virtual Local Area Networks (VLANs)Layer 3 TechniquesAccess Control ListsRoute MapsDisabling IP Routing for Complete IP Traffic IsolationCEO/CIO/CSO Emergency Disconnect Prime DirectiveWireless IEEE 802.11 LANsAccess Control to IEEE 802.11 WLANsIdentificationConfidentialityAuthorizationSingle Sign-On (SSO)Defining the Scope for SSOConfiguring User and Role-Based User Access Control ProfilesCommon ConfigurationsEnterprise SSOBest Practices for Handling Access Controls in an Enterprise OrganizationCase Studies and Examples of Enterprise Access Control Solutions That Uniquely Solve Business ChallengesPrivate Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case StudyCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 10 ASSESSMENTENDNOTES
THREE. Implementing, Testing, and Managing Access Control Systems
11. Access Control System Implementations
Transforming Access Control Policies and Standards into Procedures and GuidelinesTransform Policy Definitions into Implementation TasksApproachesImplementationFollow Standards Where ApplicableIEEENational Institute of Standards and Technology (NIST)Federal Information Security Management Act (FISMA)ISOInternet Engineering Task Force (IETF)PCI Security Standards CouncilCenter for Internet SecurityCreate Simple and Easy-to-Follow ProceduresDefine Guidelines That Departments and Business Units Can FollowIdentity Management and Access ControlUser Behavior, Application, and Network AnalysisSize and Distribution of Staff and AssetsMultilayered Access Control ImplementationsUser Access Control ProfilesSystems AccessApplications AccessFile and Folder AccessData AccessAccess Controls for Employees, Remote Employees, Customers, and Business PartnersRemote Virtual Private Network (VPN) Access—Remote Employees and WorkersIntranets—Internal Business Operations and CommunicationsExtranets—External Supply Chains, Business Partners, Distributors, and ResellersSecure E-commerce Portals with Minimum SSL 128-Bit Encryption Web PortalsSecure Online Banking Access Control ImplementationsEncryption—Minimum SSL 128-Bit Encryption Web PortalLogon/Password AccessIdentification Imaging and AuthorizationBest Practices for Access Control ImplementationsCase Studies and Examples of Access Control Implementations That Uniquely Solve Business ChallengesPrivate Sector Case StudyPublic Sector ExampleCritical Infrastructure Case StudyCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 11 ASSESSMENTENDNOTES
12. Access Control Solutions for Remote Workers
Growth in Mobile Work ForceRemote Access Methods and TechniquesIdentificationAuthenticationAuthorizationAccess Protocols to Minimize RiskAuthentication, Authorization, and Accounting (AAA)Remote Authentication Dial In User Service (RADIUS)Remote Access Server (RAS)TACACS, XTACACS, and TACACS+Differences Between RADIUS and TACACS+Remote Authentication ProtocolsVirtual Private Networks (VPNs)Web AuthenticationKnowledge-Based Authentication (KBA)Best Practices for Remote Access Controls to Support Remote WorkersCase Studies and Examples of Remote Access Control Solutions That Uniquely Solve Business ChallengesPrivate Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case StudyCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 12 ASSESSMENT
13. Public Key Infrastructure and Encryption
Public Key Infrastructure (PKI)What Is PKI?Encryption and CryptographyA Review of Symmetric and Asymmetric EncryptionBusiness Requirements for CryptographyDigital Certificates and Key ManagementSymmetric Versus Asymmetric AlgorithmsCertificate Authority (CA)Ensuring Integrity, Confidentiality, Authentication, and Non-RepudiationUse of Digital SignaturesWhat PKI Is and What It Is NotWhat Are the Potential Risks Associated with PKI?Implementations of Business CryptographyDistributionIn-House Key Management Versus Outsourced Key ManagementCertificate Authorities (CA)Why Outsourcing to a CA May Be AdvantageousRisks and Issues with Outsourcing to a CABest Practices for PKI Use Within Large Enterprises and OrganizationsCase Studies and Examples of PKI Use Within Large Organizations to Uniquely Solve Business ChallengesPrivate Sector Case StudyPublic Sector Case StudyCritical Infrastructure ExamplesCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 13 ASSESSMENT
14. Testing Access Control Systems
Purpose of Testing Access Control SystemsSoftware Development Life Cycle and the Need for Testing SoftwarePlanningRequirements AnalysisSoftware DesignDevelopmentTesting and IntegrationRelease and TrainingSupportSecurity Development Life Cycle and the Need for Testing Security SystemsInitiationAcquisition and DevelopmentImplementation and TestingOperations and MaintenanceSunset or DispositionInformation Security ActivitiesRequirements Definition—Testing the Functionality of the Original DesignDevelopment of Test Plan and ScopeIntrusive Versus Nonintrusive TestingVulnerability Assessment ScanningNmap.Nessus.Retina.Unauthorized Access and Security Breach Attack PlanGap Analysis Within the Seven Domains of a Typical IT InfrastructureUser Domain.Workstation Domain.LAN Domain.LAN-to-WAN Domain.WAN Domain.Remote Access Domain.System/Application Domain.Selection of Penetration Testing TeamsRed TeamBlue TeamTiger TeamsPerforming the Access Control System Penetration TestAssess if Access Control System Policies and Standards Are FollowedAssess if the Security Baseline Definition Is Being Achieved ThroughoutAssess if Security Countermeasures and Access Control Systems Are Implemented ProperlyPreparing the Final Test ReportIdentify Gaps and Risk Exposures and Assess ImpactDevelop Remediation Plans for Closing Identified Security Gaps Prioritized by Risk ExposurePrepare Cost Magnitude Estimate and Prioritize Security Solutions Based on Risk ExposureCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 14 ASSESSMENT
15. Access Control Assurance
What Is Information Assurance?CIA TriadConfidentialityIntegrityAvailabilityFive Pillars of IAAuthenticationNon-RepudiationParkerian HexadPossession or ControlAuthenticityUtilityHow Can Information Assurance Be Applied to Access Control Systems?Access Controls Enforce ConfidentialityAccess Controls Enforce IntegrityAccess Controls Enforce AvailabilityTraining and Information Assurance AwarenessWhat Are the Goals of Access Control System Monitoring and Reporting?What Checks and Balances Can Be Implemented?Track and Monitor Event-Type Audit LogsTrack and Monitor User-Type Audit LogsTrack and Monitor Unauthorized Access Attempts Audit LogsAudit Trail and Audit Log Management and ParsingAudit Trail and Audit Log Reporting Issues and ConcernsSecurity Information and Event Management (SIEM)Best Practices for Performing Ongoing Access Control System AssuranceCase Studies and Examples of Access Control System Assurance Strategies to Solve Business ChallengesPrivate Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case StudyCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 15 ASSESSMENTENDNOTES
A. Answer Key
B. Standard Acronyms
Glossary of Key Terms
References

Content preview from Access Control, Authentication, and Public Key Infrastructure

References

[bib-1] Carlisle, Adams, and Steve Lloyd. "Core PKI Services: Authentication, Integrity, and Confidentiality" (Microsoft TechNet, 2009). http://technet.microsoft.com/en-us/library/cc700808.aspx (accessed May 16, 2010).

[bib-2] Carlisle Adams,, and Steve Lloyd. Understanding PKI: Concepts, Standards, and Deployment Considerations, 2nd ed. New York: Addison-Wesley Professional, 2002.

[bib-3] Wil. Allsopp, Unauthorised Access: Physical Penetration Testing for IT Security Teams. Hoboken, NJ: John Wiley & Sons, 2009.

[bib-4] Thomas. Austin, PKI: A Wiley Tech Brief, 1st ed. New York: John Wiley & Sons, 2000.

[bib-5] Doris M. Baker,, Steve Burnett, and H. X. Mel. Cryptography Decrypted, 1st ed. New York: Addison-Wesley Professional, 2000.

[bib-6] ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Access Control, Authentication, and Public Key Infrastructure, 2nd Edition

Publisher Resources

ISBN: 9780763791285

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Access Control, Authentication, and Public Key Infrastructure

by Bill Ballad, Tricia Ballad, Erin Banks

References

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.