Instructor: Privilege management. 2 2
In this lesson, we're going to talk 3 3
about the different forms of access control, 4 4
because all of those relate to privileges. 5 5
Now, when I talk about privilege management, 6 6
which is the name of this lesson, 7 7
this is the use of authentication 8 8
and authorization mechanisms to provide an administrator 9 9
with centralized or decentralized control 10 10
of user and group role-based privilege management. 11 11
Essentially, we want to make sure we're able to control 12 12
what privileges a person or a group has, 13 13
and we're going to do that based on their role. 14 14
That is the best way to do it. 15 15
So if I have people who work in accounting, 16 16
they're going to have one set of permissions. 17 17
If I have people who work in IT, 18 18
they have a different set of permissions. 19 19
If I have a regular user, 20 20
they're going to have a different set of permissions. 21 21
On my system, instructors have a different set 22 22
of permissions than students 23 23
because we have different roles that we have to do. 24 24
Now, most of our policies are going to be designed 25 25
with the principles 26 26
of least privilege and separation of duty, 27 27
and these are two key concepts 28 28
that you have to be familiar with. 29 29
Now, least privilege is pretty simple. 30 30
That just means doing something 31 31
with the lowest amount of privileges possible. 32 32
If you can do it as a user, 33 33
you're just going to do it with a user account. 34 34
If you need to have administrative rights, 35 35
do you need all administrative rights or just certain ones? 36 36
If so, that would be a super user instead of 37 37
an administrative user, 38 38
and so you want to use that idea of least privilege. 39 39
Now, with separation of duties, 40 40
this is a means of establishing checks and balances 41 41
against the possibility of insider threats, 42 42
because these insider threats 43 43
can compromise critical systems and procedures. 44 44
Now, when we talk about separation of duties, 45 45
this is a system of checks and balances. 46 46
So in my company, we have a corporate checkbook. 47 47
If somebody wants to sign a check, one person can't do that. 48 48
Each of those checks has dual signatures. 49 49
Now, that means that I can sign and my COO can sign 50 50
and that means we can pay our bills that way. 51 51
It's a little bit more cumbersome 52 52
but it does make sure 53 53
that nobody can just take the checkbook 54 54
and do a single signature and steal all of our money. 55 55
My COO can't go and fly to Vegas and spend all of our money. 56 56
It doesn't work that way. 57 57
She has to have both our signatures. 58 58
That's the idea of a separation of duties here. 59 59
Now, I mentioned at the beginning 60 60
of this lesson we were going to talk 61 61
about access control types. 62 62
So, let's get into that. 63 63
Access control types. 64 64
There are four types of access controls. 65 65
There is discretionary access control, 66 66
mandatory access control, role-based access control 67 67
and attribute based access control. 68 68
Now, when we deal with discretionary access control or DAC, 69 69
this is an access control model where each resource 70 70
is protected by an access control list or ACL 71 71
and it's managed by the resource owner or owners. 72 72
If you use Microsoft Windows, 73 73
you're familiar with DAC because that's what we use. 74 74
You can right click on that properties button on the folder, 75 75
you can go to a shared folder, 76 76
you can right click on it and go to properties. 77 77
And when you do that, you'll see the attributes associated 78 78
with that access control list. 79 79
It'll say what users can read, write 80 80
or modify those folders. 81 81
That's the whole idea of discretionary access control. 82 82
The person who owns that resource can change those files 83 83
and make anybody access it that they want. 84 84
I, as assistant administrator, 85 85
have access over the entire system as well. 86 86
But Windows, by default, 87 87
is a discretionary access control system. 88 88
It is a DAC system. 89 89
Now, beyond that, we can look into MAC, 90 90
and MAC is a little bit more secure. 91 91
MAC has a lot more overhead though. 92 92
MAC is mandatory access control. 93 93
This is an access control model where resources 94 94
are protected by inflexible system defined rules 95 95
where every resource or object and every user or subject 96 96
is allocated a clearance level or a label. 97 97
Whenever I hear about MAC, I always think about labels. 98 98
Everything is labeled. 99 99
And if you think about the standard military context, 100 100
this is a MAC context. 101 101
We have a document and it's either classified as secret, 102 102
confidential, top secret, whatever that document is. 103 103
That label then tells it how it it'll be treated 104 104
inside of our system. 105 105
Now, if I wanted to read this document 106 106
it's going to check my account and say, 107 107
Jason, what clearances does he have? 108 108
He has top secret, secret, confidential, unclassified. 109 109
That means he can read all four of those. 110 110
Now, if we went and checked Mary's clearance 111 111
and she only has secret, 112 112
she wouldn't be able to read this document 113 113
because this is a top secret document 114 114
so it wouldn't show it to her. 115 115
That's the idea of MAC, and that's how these systems work. 116 116
Now, most operating systems do not support MAC 117 117
but there is one that really does it well, 118 118
and this is SELinux. 119 119
SELinux was actually developed 120 120
by the National Security Agency, the NSA, 121 121
and it provides a method for implementing MAC 122 122
within that network. 123 123
So, if you want to use MAC, remember, 124 124
there's a lot of overhead involved 125 125
but if you have something that's very classified, 126 126
it's a good system to use, and then you'd use SELinux. 127 127
Now, the next one we want to talk about 128 128
is role-based access control or RBAC. 129 129
Now, RBAC is an access control model 130 130
where resources are protected by ACLs 131 131
that are managed by administrators 132 132
and can provide user permissions based on job functions. 133 133
So, going back to my earlier example, 134 134
I take all my accountants and I put 'em in one group 135 135
then I can give that group permissions. 136 136
That would be a role-based access control. 137 137
Because I'm going to be able to implement this 138 138
through the concept of groups inside of Windows. 139 139
That's the idea of doing RBAC. 140 140
Now, this isn't a perfect implementation of RBAC 141 141
but it does get the job done most of the way 142 142
and so we will consider that 143 143
an implementation inside of Windows. 144 144
Another one we can use is attribute based. 145 145
Attribute based access control or ABAC 146 146
is an access control technique 147 147
that evaluates a set of attributes 148 148
that each subject possesses 149 149
to determine if access should be granted. 150 150
Now, ABAC can be used to implement controls 151 151
for separation of duties. 152 152
So, I can say that I'm part of the A group 153 153
and somebody else is part of the B group. 154 154
And based on that, we have certain attributes. 155 155
So, there are certain things 156 156
that A group people can do 157 157
and B group people can do. 158 158
And because of those attributes associated with each of us, 159 159
we can then do certain things 160 160
and that would separate our duties. 161 161
ABAC is by far the most complicated type of access control 162 162
to implement 163 163
but it does give you the most flexibility 164 164
because you're not doing things based on groups anymore, 165 165
you're doing it based on a single subject. 166 166
And so I can actually have down to the individual person 167 167
what specific attributes they have 168 168
and therefore what specific things they can do 169 169
on that system.