1 00:00:00,060 --> 00:00:00,893 In this lesson, 2 00:00:00,893 --> 00:00:03,750 we're going to explore access control models. 3 00:00:03,750 --> 00:00:06,330 There are many different types of access control models, 4 00:00:06,330 --> 00:00:09,330 but in this lesson, we will focus on the five primary models 5 00:00:09,330 --> 00:00:11,460 which are known as mandatory access control, 6 00:00:11,460 --> 00:00:15,000 discretionary access control, role-based access control, 7 00:00:15,000 --> 00:00:16,470 rule-based access control, 8 00:00:16,470 --> 00:00:19,050 and attribute-based access control. 9 00:00:19,050 --> 00:00:21,870 Then we will also review a few other types 10 00:00:21,870 --> 00:00:23,550 of access control restrictions, 11 00:00:23,550 --> 00:00:25,260 such as time of day restrictions 12 00:00:25,260 --> 00:00:27,750 and the implementation of least privilege. 13 00:00:27,750 --> 00:00:29,460 The first model we have is known as 14 00:00:29,460 --> 00:00:33,390 mandatory access control, also known by its acronym as MAC. 15 00:00:33,390 --> 00:00:35,910 Mandatory access control uses security labels 16 00:00:35,910 --> 00:00:38,070 to determine which users are authorized 17 00:00:38,070 --> 00:00:39,810 to access a particular resource. 18 00:00:39,810 --> 00:00:42,420 This type of access control is complex to configure 19 00:00:42,420 --> 00:00:44,520 and more expensive to maintain, therefore, 20 00:00:44,520 --> 00:00:47,280 it is generally reserved for high security systems. 21 00:00:47,280 --> 00:00:49,620 Under this system, anything that is not specifically allowed 22 00:00:49,620 --> 00:00:53,130 is considered forbidden and is not accessible by the users. 23 00:00:53,130 --> 00:00:56,070 For this system to work effectively, every single user 24 00:00:56,070 --> 00:00:58,920 and resource must be assigned a security label. 25 00:00:58,920 --> 00:01:00,840 If the user's level is not equal 26 00:01:00,840 --> 00:01:02,520 or higher to the resource's level, 27 00:01:02,520 --> 00:01:05,069 then the user is blocked from accessing that resource. 28 00:01:05,069 --> 00:01:06,960 For example, if you're working for the military 29 00:01:06,960 --> 00:01:09,150 and you have been labeled as having a secret clearance, 30 00:01:09,150 --> 00:01:10,500 you can access anything on the system 31 00:01:10,500 --> 00:01:12,450 that is labeled secret, confidential, 32 00:01:12,450 --> 00:01:14,910 or unclassified since your secret clearance 33 00:01:14,910 --> 00:01:17,190 is at or above these three levels. 34 00:01:17,190 --> 00:01:20,070 But if you try to access a file labeled as top secret 35 00:01:20,070 --> 00:01:22,770 in a Mac-based system, you will be denied access 36 00:01:22,770 --> 00:01:24,420 since your secret clearance is lower 37 00:01:24,420 --> 00:01:26,190 than the required top secret clearance 38 00:01:26,190 --> 00:01:27,990 needed to view that file. 39 00:01:27,990 --> 00:01:30,480 The second model is known as discretionary access control, 40 00:01:30,480 --> 00:01:31,440 or DAC. 41 00:01:31,440 --> 00:01:33,360 With discretionary access control, 42 00:01:33,360 --> 00:01:36,270 a resource's owner is allowed to specify 43 00:01:36,270 --> 00:01:38,460 which user can access each resource. 44 00:01:38,460 --> 00:01:40,290 Using discretionary access control, 45 00:01:40,290 --> 00:01:43,260 the access is determined based on a user's identity, 46 00:01:43,260 --> 00:01:45,540 profile, or role, and this is considered 47 00:01:45,540 --> 00:01:47,400 a form of need to know access control. 48 00:01:47,400 --> 00:01:50,250 For example, if you decided to share a file on your computer 49 00:01:50,250 --> 00:01:52,020 with me over the corporate network, 50 00:01:52,020 --> 00:01:54,240 you could easily use discretionary access control 51 00:01:54,240 --> 00:01:57,120 by adding my username to the authorized users 52 00:01:57,120 --> 00:01:58,590 under your file sharing settings 53 00:01:58,590 --> 00:02:00,480 for that one file or folder. 54 00:02:00,480 --> 00:02:03,720 The third model is known as role-based access control. 55 00:02:03,720 --> 00:02:06,000 Role-based access control allows an administrator 56 00:02:06,000 --> 00:02:09,150 to assign each user to one or more roles, 57 00:02:09,150 --> 00:02:11,760 and then use those roles to assign permissions 58 00:02:11,760 --> 00:02:13,800 to the organization's resources. 59 00:02:13,800 --> 00:02:16,560 In Windows domain environment, role-based access control 60 00:02:16,560 --> 00:02:18,660 is normally implemented by using groups, 61 00:02:18,660 --> 00:02:21,420 and these groups can also be set up in the structure 62 00:02:21,420 --> 00:02:23,940 that mimics your organizational hierarchy. 63 00:02:23,940 --> 00:02:26,340 For example, we might create one group 64 00:02:26,340 --> 00:02:27,480 for the accounting department 65 00:02:27,480 --> 00:02:29,970 and another group for the human resources department. 66 00:02:29,970 --> 00:02:33,450 Based on those groups or roles, we can assign each group 67 00:02:33,450 --> 00:02:35,490 with access to different resources. 68 00:02:35,490 --> 00:02:37,830 Additionally, we could put both of these groups 69 00:02:37,830 --> 00:02:39,870 into a higher level group called employees 70 00:02:39,870 --> 00:02:41,550 that has access to other resources 71 00:02:41,550 --> 00:02:44,220 that every employee might need access to. 72 00:02:44,220 --> 00:02:46,380 Role-based access control can be used 73 00:02:46,380 --> 00:02:49,170 to enforce minimal privileges for a subject 74 00:02:49,170 --> 00:02:51,150 based on all of the associated groups, 75 00:02:51,150 --> 00:02:53,430 and users can be members of one 76 00:02:53,430 --> 00:02:55,770 or more groups based on those roles. 77 00:02:55,770 --> 00:02:58,620 This type of access control works well for organizations 78 00:02:58,620 --> 00:03:00,810 with a high rate of employee turnover 79 00:03:00,810 --> 00:03:02,970 since permissions are based on work role 80 00:03:02,970 --> 00:03:05,610 rather than an individual's username. 81 00:03:05,610 --> 00:03:08,730 The fourth model is known as rule-based access control. 82 00:03:08,730 --> 00:03:11,370 Rule-based access control allows administrators 83 00:03:11,370 --> 00:03:14,490 to implement security policies across all of their users. 84 00:03:14,490 --> 00:03:16,050 This allows for the use of rules 85 00:03:16,050 --> 00:03:18,660 that may be changed quickly and frequently. 86 00:03:18,660 --> 00:03:22,470 For example, access control lists are set up on routers 87 00:03:22,470 --> 00:03:25,500 and firewalls as a form of rule-based access control, 88 00:03:25,500 --> 00:03:26,820 and when they are implemented, 89 00:03:26,820 --> 00:03:29,610 they affect all users on the given network segment. 90 00:03:29,610 --> 00:03:32,280 The fifth model is known as an attribute-based 91 00:03:32,280 --> 00:03:35,100 access control, or ABAC. 92 00:03:35,100 --> 00:03:36,930 Attribute-based access control 93 00:03:36,930 --> 00:03:39,240 relies on a set of characteristics of an object 94 00:03:39,240 --> 00:03:41,520 to make an access control decision. 95 00:03:41,520 --> 00:03:44,550 User attributes include things like the user's name, 96 00:03:44,550 --> 00:03:48,150 role, organization. ID, or security clearance level. 97 00:03:48,150 --> 00:03:50,280 Environment attributes include things 98 00:03:50,280 --> 00:03:52,800 like the time of access, the location of the data, 99 00:03:52,800 --> 00:03:55,710 and the current organization's threat level. 100 00:03:55,710 --> 00:03:58,770 Resource attributes include things like the creation date 101 00:03:58,770 --> 00:04:01,230 of the file or object, the resource owner, 102 00:04:01,230 --> 00:04:04,320 the file name, and the data sensitivity. 103 00:04:04,320 --> 00:04:06,900 Depending on these various users, environment, 104 00:04:06,900 --> 00:04:09,870 or resource attributes, access is permitted or denied 105 00:04:09,870 --> 00:04:12,420 to the individual requesting access. 106 00:04:12,420 --> 00:04:15,450 For example, our company's SharePoint site on our intranet 107 00:04:15,450 --> 00:04:17,940 may look different when we log in to it from our account 108 00:04:17,940 --> 00:04:20,550 than it does when our coworkers log in based on 109 00:04:20,550 --> 00:04:23,610 what access rules are applied to our individual accounts 110 00:04:23,610 --> 00:04:25,230 and where we are logging in from, 111 00:04:25,230 --> 00:04:28,140 either from the corporate office or from our home office. 112 00:04:28,140 --> 00:04:29,760 So now that we have an understanding 113 00:04:29,760 --> 00:04:32,280 of the five basic models used in access control, 114 00:04:32,280 --> 00:04:34,710 let's take a quick look at time of day restrictions 115 00:04:34,710 --> 00:04:36,870 and the implementation of least privilege. 116 00:04:36,870 --> 00:04:38,340 With time of day restrictions, 117 00:04:38,340 --> 00:04:40,980 access control can limit access to resources 118 00:04:40,980 --> 00:04:43,890 based off the time of day that the request is made. 119 00:04:43,890 --> 00:04:46,620 This type of restriction is often used in conjunction 120 00:04:46,620 --> 00:04:48,540 with other access control models 121 00:04:48,540 --> 00:04:51,060 to provide an additional layer of security. 122 00:04:51,060 --> 00:04:52,830 For example, your organization 123 00:04:52,830 --> 00:04:55,660 might have regular working hours of 8:00 AM 124 00:04:55,660 --> 00:04:57,840 to 6:00 PM daily, and if someone tries to log in 125 00:04:57,840 --> 00:04:59,220 to their workstation at 2:00 AM, 126 00:04:59,220 --> 00:05:01,350 this could be blocked since it's outside 127 00:05:01,350 --> 00:05:03,810 of the normal working hours for your organization. 128 00:05:03,810 --> 00:05:05,670 This rule will therefore only provide access 129 00:05:05,670 --> 00:05:08,550 to our organization systems during a specific time period, 130 00:05:08,550 --> 00:05:10,620 and by configuring time of day restrictions, 131 00:05:10,620 --> 00:05:13,560 you can prevent insider threat based on malicious activity 132 00:05:13,560 --> 00:05:15,990 since none of your users will have access to the system 133 00:05:15,990 --> 00:05:18,660 during irregular hours when malicious activity 134 00:05:18,660 --> 00:05:20,310 is most often carried out. 135 00:05:20,310 --> 00:05:22,590 Finally, let's take a look at the principle 136 00:05:22,590 --> 00:05:23,670 of least privilege. 137 00:05:23,670 --> 00:05:26,220 The principle of least privilege is a cybersecurity concept 138 00:05:26,220 --> 00:05:28,770 that states the user is given the minimal levels 139 00:05:28,770 --> 00:05:31,680 of access necessary to complete his or her job functions, 140 00:05:31,680 --> 00:05:33,210 and nothing additional. 141 00:05:33,210 --> 00:05:34,890 This principle is usually applied 142 00:05:34,890 --> 00:05:37,830 by choosing one of the five access control models 143 00:05:37,830 --> 00:05:40,590 we covered in this lesson, and they are then used 144 00:05:40,590 --> 00:05:43,110 to restrict the permissions granted to users, 145 00:05:43,110 --> 00:05:45,840 systems, and processes to the bare minimum 146 00:05:45,840 --> 00:05:48,090 necessary to perform their intended functions. 147 00:05:48,090 --> 00:05:50,610 For example, a user who only needs to read data 148 00:05:50,610 --> 00:05:52,320 from a database should not have the ability 149 00:05:52,320 --> 00:05:55,320 to write or modify data contained in that database 150 00:05:55,320 --> 00:05:57,690 by limiting the user privileges in this way. 151 00:05:57,690 --> 00:05:59,490 The potential damage that they can cause 152 00:05:59,490 --> 00:06:01,080 either intentionally or unintentionally 153 00:06:01,080 --> 00:06:02,700 is greatly minimized. 154 00:06:02,700 --> 00:06:04,710 Another benefit of using least privilege 155 00:06:04,710 --> 00:06:07,350 is that it can help to mitigate the risk 156 00:06:07,350 --> 00:06:10,140 of an account being able to conduct a lot of actions 157 00:06:10,140 --> 00:06:12,870 if it was to become compromised by a threat actor. 158 00:06:12,870 --> 00:06:15,570 Another aspect of least privilege that you should implement 159 00:06:15,570 --> 00:06:17,640 is the continual review of your user's permissions 160 00:06:17,640 --> 00:06:20,130 to ensure that permissions or authorization creep 161 00:06:20,130 --> 00:06:21,420 is not occurring. 162 00:06:21,420 --> 00:06:23,280 Permission or authorization creep 163 00:06:23,280 --> 00:06:25,530 refers to the situation where a user acquires 164 00:06:25,530 --> 00:06:28,230 more and more rights as they move from one position 165 00:06:28,230 --> 00:06:29,670 to another within the company. 166 00:06:29,670 --> 00:06:32,400 And eventually, they will have entirely too much access 167 00:06:32,400 --> 00:06:33,990 across your enterprise network 168 00:06:33,990 --> 00:06:36,180 based on their current job role. 169 00:06:36,180 --> 00:06:38,430 For example, if I just hired a new employee 170 00:06:38,430 --> 00:06:41,520 named Samantha to work in our student support department, 171 00:06:41,520 --> 00:06:43,440 she would be granted access to that department's 172 00:06:43,440 --> 00:06:44,790 permissions levels, including access 173 00:06:44,790 --> 00:06:47,220 to our student support systems, billing system, 174 00:06:47,220 --> 00:06:49,380 learning management system, and some others, 175 00:06:49,380 --> 00:06:52,080 but she would not have access to our production team's files 176 00:06:52,080 --> 00:06:55,320 or have the same levels of permission as they do. 177 00:06:55,320 --> 00:06:57,330 Now, if Samantha gets a promotion 178 00:06:57,330 --> 00:06:59,310 and moves to our business development department, 179 00:06:59,310 --> 00:07:00,750 she will get new permissions 180 00:07:00,750 --> 00:07:03,360 that match her new job function in that department, 181 00:07:03,360 --> 00:07:05,400 but if we don't remove her old permissions, 182 00:07:05,400 --> 00:07:08,400 she will now have permissions for both the student support 183 00:07:08,400 --> 00:07:10,980 and the business development departments. 184 00:07:10,980 --> 00:07:13,260 Now, let's fast forward another 12 months, 185 00:07:13,260 --> 00:07:15,420 and now Samantha finished a bunch of training 186 00:07:15,420 --> 00:07:17,760 and has become a full stack web developer. 187 00:07:17,760 --> 00:07:19,470 She also applies for a new position 188 00:07:19,470 --> 00:07:21,840 and gets one in our software development team. 189 00:07:21,840 --> 00:07:23,970 Now she has three sets of permissions, 190 00:07:23,970 --> 00:07:26,400 but this violates the principle of least privilege. 191 00:07:26,400 --> 00:07:28,500 So when she accepts her promotion 192 00:07:28,500 --> 00:07:30,570 and moves into the software development team, 193 00:07:30,570 --> 00:07:32,760 her old permissions from the student support group 194 00:07:32,760 --> 00:07:34,740 and the business development department 195 00:07:34,740 --> 00:07:38,100 should be revoked to maintain high levels of data security 196 00:07:38,100 --> 00:07:40,620 for our systems and its sensitive data. 197 00:07:40,620 --> 00:07:43,740 So remember, when it comes to access control, 198 00:07:43,740 --> 00:07:46,410 you have five different types that you can implement, 199 00:07:46,410 --> 00:07:49,740 mandatory access control, discretionary access control, 200 00:07:49,740 --> 00:07:53,220 role-based access control, rule-based access control, 201 00:07:53,220 --> 00:07:55,740 and attribute-based access control. 202 00:07:55,740 --> 00:07:58,020 With mandatory access control, or MAC, 203 00:07:58,020 --> 00:08:00,510 the user is granted or denied access 204 00:08:00,510 --> 00:08:03,420 based on the policies dictated by the central authority. 205 00:08:03,420 --> 00:08:05,910 With discretionary access control, or DAC, 206 00:08:05,910 --> 00:08:07,830 the owner of the information or resource 207 00:08:07,830 --> 00:08:09,900 determines who can access it. 208 00:08:09,900 --> 00:08:13,080 With role-based access control, or RBAC, 209 00:08:13,080 --> 00:08:14,700 the access permissions are based 210 00:08:14,700 --> 00:08:17,130 on the roles within the given organization. 211 00:08:17,130 --> 00:08:21,150 With rule-based access control, also abbreviated as RBAC, 212 00:08:21,150 --> 00:08:23,160 user access is granted or denied 213 00:08:23,160 --> 00:08:26,940 based on a set of rules defined by a system administrator. 214 00:08:26,940 --> 00:08:30,090 With attribute-based access control, or ABAC, 215 00:08:30,090 --> 00:08:32,130 the user's access is granted or denied 216 00:08:32,130 --> 00:08:33,900 based on the attributes associated 217 00:08:33,900 --> 00:08:36,840 with a user, an action, or a resource. 218 00:08:36,840 --> 00:08:39,299 Also, access controls can have limits 219 00:08:39,299 --> 00:08:41,730 placed on the user's access to resources 220 00:08:41,730 --> 00:08:44,850 based on the time of day that a request is made. 221 00:08:44,850 --> 00:08:46,950 Finally, we cover the principle of least privilege, 222 00:08:46,950 --> 00:08:49,230 which is a cybersecurity concept that states 223 00:08:49,230 --> 00:08:51,480 that a user is given the minimum levels 224 00:08:51,480 --> 00:08:54,570 of access necessary to complete his or her job functions 225 00:08:54,570 --> 00:08:56,940 or work role, and nothing additional. 226 00:08:56,940 --> 00:08:59,490 By configuring proper access control on your network, 227 00:08:59,490 --> 00:09:01,260 you can ensure that your enterprise network 228 00:09:01,260 --> 00:09:04,233 and systems are well protected against unauthorized access.