Computer access control

Short description: Ways of controlling usage of a computer

## Contents

* 1 Software entities
* 2 Services
* 3 Authorization
* 4 Identification and authentication
* 5 Access approval
* 6 Accountability
* 7 Access controls
* 7.1 Discretionary access control
* 7.2 Mandatory access control
* 7.3 Role-based access control
* 7.4 Attribute-based access control
* 7.5 Break-Glass Access Control Models
* 7.6 Host-based access control (HBAC)
* 8 See also
* 9 References

## Software entities

As of 2014[update], access-control models tend to fall into one of two classes: those based on capabilities and those based on access control lists (ACLs).

* In a capability-based model, holding an unforged-able reference or capability to an object, that provides access to the object (roughly analogous to how possession of one's house key grants one access to one's house); access is conveyed to another party by transmitting such a capability over a secure channel.
* In an ACL-based model, a subject's access to an object or group of objects [1] depends on whether its identity appears on a list associated with the object (roughly analogous to how a bouncer at a private party would check an ID to see if a name appears on the guest list); access is conveyed by editing the list. (Different ACL systems have a variety of different conventions regarding who or what is responsible for editing the list and how it is edited.)

## Services

* authorization specifies what a subject can do
* identification and authentication ensure that only legitimate subjects can log on to a system
* access approval grants access during operations, by association of users with the resources that they are allowed to access, based on the authorization policy
* accountability identifies what a subject (or all subjects associated with a user) did

## Authorization

* Read (R): The subject can:
* Read file contents
* List directory contents
* Write (W): The subject can change the contents of a file or directory with the following tasks:
* Add
* Update
* Delete
* Rename
* Execute (X): If the file is a program, the subject can cause the program to be run. (In Unix-style systems, the "execute" permission doubles as a "traverse directory" permission when granted for a directory.)

These rights and permissions are implemented differently in systems based on discretionary access control (DAC) and mandatory access control (MAC).

## Identification and authentication

Main article: Authentication

* Something you know, such as a password or a personal identification number (PIN). This assumes that only the owner of the account knows the password or PIN needed to access the account.
* Something you have, such as a smart card or security token. This assumes that only the owner of the account has the necessary smart card or token needed to unlock the account.
* Something you are, such as fingerprint, voice, retina, or iris characteristics.
* Where you are, for example inside or outside a company firewall, or proximity of login location to a personal GPS device.

## Access approval

Access approval is the function that actually grants or rejects access during operations.[2]

During access approval, the system compares the formal representation of the authorization policy with the access request, to determine whether the request shall be granted or rejected. Moreover, the access evaluation can be done online/ongoing.[3]

## Accountability

* Detecting security violations
* Re-creating security incidents

* More than three failed logon attempts in a given period
* Any attempt to use a disabled user account

These reports help a system administrator or security administrator to more easily identify possible break-in attempts. – Definition of clipping level:[4] a disk's ability to maintain its magnetic properties and hold its content. A high-quality level range is 65–70%; low quality is below 55%.

## Access controls

### Discretionary access control

Discretionary access control (DAC) is a policy determined by the owner of an object. The owner decides who is allowed to access the object, and what privileges they have.

* File and data ownership: Every object in the system has an owner. In most DAC systems, each object's initial owner is the subject that caused it to be created. The access policy for an object is determined by its owner.
* Access rights and permissions: These are the controls that an owner can assign to other subjects for specific resources.

Access controls may be discretionary in ACL-based or capability-based access control systems. (In capability-based systems, there is usually no explicit concept of 'owner', but the creator of an object has a similar degree of control over its access policy.)

### Mandatory access control

* Sensitivity labels: In such a system subjects and objects must have labels assigned to them. A subject's sensitivity label specifies its level of trust. An object's sensitivity label specifies the level of trust required for access. In order to access a given object, the subject must have a sensitivity level equal to or higher than the requested object.
* Data import and export: Controlling the import of information from other systems and export to other systems (including printers) is a critical function of these systems, which must ensure that sensitivity labels are properly maintained and implemented so that sensitive information is appropriately protected at all times.

* Rule-based (or label-based) access control: This type of control further defines specific conditions for access to a requested object. A Mandatory Access Control system implements a simple form of rule-based access control to determine whether access should be granted or denied by matching:
* An object's sensitivity label
* A subject's sensitivity label
* Lattice-based access control: These can be used for complex access control decisions involving multiple objects and/or subjects. A lattice model is a mathematical structure that defines greatest lower-bound and least upper-bound values for a pair of elements, such as a subject and an object.

Few systems implement MAC; XTS-400 and SELinux are examples of systems that do.

### Role-based access control

Role-based access control (RBAC) is an access policy determined by the system, not by the owner. RBAC is used in commercial applications and also in military systems, where multi-level security requirements may also exist. RBAC differs from DAC in that DAC allows users to control access to their resources, while in RBAC, access is controlled at the system level, outside of the user's control. Although RBAC is non-discretionary, it can be distinguished from MAC primarily in the way permissions are handled. MAC controls read and write permissions based on a user's clearance level and additional labels. RBAC controls collections of permissions that may include complex operations such as an e-commerce transaction, or may be as simple as read or write. A role in RBAC can be viewed as a set of permissions.

Three primary rules are defined for RBAC:

1. Role assignment: A subject can execute a transaction only if the subject has selected or been assigned a suitable role.
2. Role authorization: A subject's active role must be authorized for the subject. With rule 1 above, this rule ensures that users can take on only roles for which they are authorized.
3. Transaction authorization: A subject can execute a transaction only if the transaction is authorized for the subject's active role. With rules 1 and 2, this rule ensures that users can execute only transactions for which they are authorized.

Additional constraints may be applied as well, and roles can be combined in a hierarchy where higher-level roles subsume permissions owned by lower-level sub-roles.

Most IT vendors offer RBAC in one or more products.

### Attribute-based access control

In attribute-based access control (ABAC),[5][6] access is granted not based on the rights of the subject associated with a user after authentication, but based on the attributes of the subject, object, requested operations, and environment conditions against policy, rules, or relationships that describe the allowable operations for a given set of attributes.[7] The user has to prove so-called claims about his or her attributes to the access control engine. An attribute-based access control policy specifies which claims need to be satisfied in order to grant access to an object. For instance the claim could be "older than 18". Any user that can prove this claim is granted access. Users can be anonymous when authentication and identification are not strictly required. One does, however, require means for proving claims anonymously. This can for instance be achieved using anonymous credentials. XACML (extensible access control markup language) is a standard for attribute-based access control. XACML 3.0 was standardized in January 2013.[8]

### Break-Glass Access Control Models

Traditionally, access has the purpose of restricting access, thus most access control models follow the "default deny principle", i.e. if a specific access request is not explicitly allowed, it will be denied. This behavior might conflict with the regular operations of a system. In certain situations, humans are willing to take the risk that might be involved in violating an access control policy, if the potential benefit that can be achieved outweighs this risk. This need is especially visible in the health-care domain, where a denied access to patient records can cause the death of a patient. Break-Glass (also called break-the-glass) try to mitigate this by allowing users to override access control decision. Break-Glass can either be implemented in an access control specific manner (e.g. into RBAC),[9] or generic (i.e., independent from the underlying access control model).[10]

### Host-based access control (HBAC)

The initialism HBAC stands for "host-based access control".[11]

## See also

* Resource Access Control Facility

## References

1. ↑ Feio, Rui (August 12, 2014). ABCs of IBM Z/OS System Programming Volume 6 (2nd ed.). IBM Corporation. p. 24. ISBN 9780738439808. https://books.google.com/books?id=vYdFBAAAQBAJ. Retrieved December 17, 2024.
2. ↑ Dieter Gollmann. Computer Security, 3rd ed. Wiley Publishing, 2011, p. 387, bottom
3. ↑ Marcon, A. L.; Olivo Santin, A.; Stihler, M.; Bachtold, J., "A UCONabc Resilient Authorization Evaluation for Cloud Computing," Parallel and Distributed Systems, IEEE Transactions on, vol. 25, no. 2, pp. 457–467, Feb. 2014 doi:10.1109/TPDS.2013.113, bottom
4. ↑ "Definition of: clipping level". PC Magazine. https://www.pcmag.com/encyclopedia_term/0,2542,t=clipping+level&i;=39821,00.asp. Retrieved 2017-08-26.
5. ↑ Jin, Xin, Ram Krishnan, and Ravi Sandhu. "A unified attribute-based access control model covering dac, mac and rbac." Data and Applications Security and Privacy XXVI. Springer Berlin Heidelberg, 2012. 41–55.
6. ↑ Hu, Vincent C.; Ferraiolo, David; Kuhn, Rick; Schnitzer, Adam; Sandlin, Kenneth; Miller, Robert; Scarfone, Karen. Guide to Attribute Based Access Control (ABAC) Definition and Considerations. http://csrc.nist.gov/publications/drafts/800-162/sp800_162_draft.pdf.
7. ↑ Hu, Vincent C. (2013). "Guide to Attribute Based Access Control (ABAC) Definition and Considerations (Draft)". National Institute of Standards and Technology 800 (162): 54. https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=cab698a5b0949aa7acd0858b55352c5df0a2c2fb.
8. ↑ eXtensible Access Control Markup Language (XACML) V3.0 approved as an OASIS Standard, eXtensible Access Control Markup Language (XACML) V3.0 approved as an OASIS Standard.
9. ↑ Ferreira, Ana; Chadwick, David; Farinha, Pedro; Correia, Ricardo; Zao, Gansen; Chiro, Rui; Antunes, Luis (2009). "How to Securely Break into RBAC: The BTG-RBAC Model". IEEE. pp. 23–31. doi:10.1109/ACSAC.2009.12.
10. ↑ Brucker, Achim D.; Petritsch, Helmut (2009). "Extending Access Control Models with Break-glass.". ACM Press. pp. 197–206. doi:10.1145/1542207.1542239. http://www.brucker.ch/bibliography/abstract/brucker.ea-extending-2009.en.html.
11. ↑ Ballard, Ella Deon (2013). "Identity Management Guide: Managing Identity and Authorization Policies for Linux-Based Infrastructures". Red Hat. https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/HBAC_Service_Groups.html. Retrieved 2014-01-06. "Any PAM service can be identified as to the host-based access control (HBAC) system in IdM."

This article is part of a series on

Information security
Related security categories

* Internet security
* Automotive security
* Cyberwarfare
* Computer security
* Mobile security
* Network security

Threats

* Advanced persistent threat
* Computer crime
* Vulnerabilities
* Eavesdropping
* Malware
* Spyware
* Ransomware
* Trojans
* Viruses
* Worms
* Rootkits
* Bootkits
* Keyloggers
* Screen scrapers
* Exploits
* Backdoors
* Logic bombs
* Payloads
* Denial of service
* Web shells
* Web application security
* Phishing

Defenses

* Computer access control
* Application security
* Antivirus software
* Secure coding
* Secure by default
* Secure by design
* Secure operating systems
* Authentication
* Multi-factor authentication
* Authorization
* Data-centric security
* Encryption
* Firewall
* Intrusion detection system
* Mobile secure gateway
* Runtime application self-protection (RASP)

* v
* t
* e

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Computer access control. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Computer_access_control&oldid=4348182"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template