1 1 00:00:00,540 --> 00:00:02,190 Access controls. 2 2 00:00:02,190 --> 00:00:04,470 In this lesson we are going to start talking about 3 3 00:00:04,470 --> 00:00:06,810 access controls and how we can use those 4 4 00:00:06,810 --> 00:00:08,850 to protect our information. 5 5 00:00:08,850 --> 00:00:10,920 Now, an access control model can be applied 6 6 00:00:10,920 --> 00:00:13,890 to any type of data or software resource. 7 7 00:00:13,890 --> 00:00:15,840 There are lots of different ways of doing this 8 8 00:00:15,840 --> 00:00:18,390 including looking at things on our file systems, 9 9 00:00:18,390 --> 00:00:22,350 our network storage, or our database security. 10 10 00:00:22,350 --> 00:00:24,660 Now, when we do this, usually we're going to use something 11 11 00:00:24,660 --> 00:00:27,560 like an ACL, and each record in an ACL 12 12 00:00:27,560 --> 00:00:31,620 or access control list is known as an access control entry. 13 13 00:00:31,620 --> 00:00:35,340 This is very commonly used inside of file systems, networks, 14 14 00:00:35,340 --> 00:00:37,470 and even inside a databases. 15 15 00:00:37,470 --> 00:00:39,870 Now, if you're doing it inside of a file system, 16 16 00:00:39,870 --> 00:00:41,100 you're going to have to have a file system 17 17 00:00:41,100 --> 00:00:42,840 that supports ACLs. 18 18 00:00:42,840 --> 00:00:46,140 This includes things like NTFS inside of Windows Systems, 19 19 00:00:46,140 --> 00:00:49,860 EXT3 or EXT4 inside of Linux Systems, 20 20 00:00:49,860 --> 00:00:53,730 or the new ZFS file system inside of Linux Systems. 21 21 00:00:53,730 --> 00:00:55,440 Now, if you're going to be doing this inside of your 22 22 00:00:55,440 --> 00:00:58,080 database, your database security can allow 23 23 00:00:58,080 --> 00:01:00,870 for more fine grain permission configuration. 24 24 00:01:00,870 --> 00:01:03,570 Now, this is really nice because inside of your database 25 25 00:01:03,570 --> 00:01:05,820 you can actually control information 26 26 00:01:05,820 --> 00:01:09,060 on the data itself based on it's tables, it's views, 27 27 00:01:09,060 --> 00:01:11,850 it's records, it's fields, and things like that. 28 28 00:01:11,850 --> 00:01:14,070 But you can also apply access control 29 29 00:01:14,070 --> 00:01:16,230 to the different statements you can apply to a database, 30 30 00:01:16,230 --> 00:01:19,650 such as the select, insert, update, or delete statements. 31 31 00:01:19,650 --> 00:01:21,840 And so you really do have a fine grain permission 32 32 00:01:21,840 --> 00:01:23,580 configuration inside of a database 33 33 00:01:23,580 --> 00:01:25,170 that you don't have with files. 34 34 00:01:25,170 --> 00:01:26,490 Now, another area that we can talk 35 35 00:01:26,490 --> 00:01:29,940 about access control is geographic access requirements. 36 36 00:01:29,940 --> 00:01:32,040 Now, with geographic access requirements, 37 37 00:01:32,040 --> 00:01:34,800 these primarily are going to fall into two different types. 38 38 00:01:34,800 --> 00:01:37,380 This might be talking about the storage location 39 39 00:01:37,380 --> 00:01:39,300 or the employees themself. 40 40 00:01:39,300 --> 00:01:40,890 When we talk about storage locations 41 41 00:01:40,890 --> 00:01:43,590 we have to consider data sovereignty issues. 42 42 00:01:43,590 --> 00:01:45,480 This includes if I'm going to put my server 43 43 00:01:45,480 --> 00:01:47,850 in a particular location, because based on that, 44 44 00:01:47,850 --> 00:01:49,500 there's going to be different laws that I'm going to have to 45 45 00:01:49,500 --> 00:01:51,450 figure out and which ones I'm going to comply 46 46 00:01:51,450 --> 00:01:53,340 with based on that location. 47 47 00:01:53,340 --> 00:01:55,050 And so there's different privacy around the world, 48 48 00:01:55,050 --> 00:01:56,670 as we've talked about before. 49 49 00:01:56,670 --> 00:01:58,500 But in addition to that, we might also be thinking 50 50 00:01:58,500 --> 00:02:00,060 about the geographic access requirements 51 51 00:02:00,060 --> 00:02:01,710 from an employee standpoint. 52 52 00:02:01,710 --> 00:02:04,050 For instance, if I have an employee who takes their laptop 53 53 00:02:04,050 --> 00:02:07,200 and they go on travel, can they connect back to our network? 54 54 00:02:07,200 --> 00:02:09,000 Well, sometimes employees need access 55 55 00:02:09,000 --> 00:02:11,130 from multiple geographic locations. 56 56 00:02:11,130 --> 00:02:13,470 For instance, I tend to travel a lot for work, 57 57 00:02:13,470 --> 00:02:15,690 so I might be in America this week, 58 58 00:02:15,690 --> 00:02:18,570 in Europe next week, and in Asia the week after that 59 59 00:02:18,570 --> 00:02:20,070 and so I might have to access it 60 60 00:02:20,070 --> 00:02:21,720 from different locations around the world. 61 61 00:02:21,720 --> 00:02:23,490 And so we have to keep that in mind 62 62 00:02:23,490 --> 00:02:25,560 as we're designing our systems. 63 63 00:02:25,560 --> 00:02:27,090 Now, one way you can accomplish this is 64 64 00:02:27,090 --> 00:02:29,730 by using cloud-based systems where you have multiple nodes 65 65 00:02:29,730 --> 00:02:30,840 around the world. 66 66 00:02:30,840 --> 00:02:32,670 But this is something you have to consider when 67 67 00:02:32,670 --> 00:02:34,860 you're thinking about your employees or even your end users 68 68 00:02:34,860 --> 00:02:36,990 and how they're going to access your systems. 69 69 00:02:36,990 --> 00:02:37,823 In addition to that, 70 70 00:02:37,823 --> 00:02:39,810 you want to think about from the security side too. 71 71 00:02:39,810 --> 00:02:40,920 If you don't have a need 72 72 00:02:40,920 --> 00:02:43,500 for people to access your systems from around the world, 73 73 00:02:43,500 --> 00:02:46,260 you can geographically block people and say, you know what? 74 74 00:02:46,260 --> 00:02:48,810 We're only going to allow Americans to access our service, 75 75 00:02:48,810 --> 00:02:51,660 or only people in Florida to access or service, 76 76 00:02:51,660 --> 00:02:53,730 or even only people in Orlando, Florida 77 77 00:02:53,730 --> 00:02:54,900 to access our service. 78 78 00:02:54,900 --> 00:02:57,510 And you can really narrow it down based on the security 79 79 00:02:57,510 --> 00:02:59,860 and the requirements for your own organization.