Access Controls Cont.

This week I continued reading over access controls in the intro to CISSP book. The two categories of access controls are:

·         System access controls: Controls in this category protect the entire system and provide a first line of defense for the data contained on the system.

·         Data access controls: Controls in this category are specifically implemented to protect the data contained on the system.

System access controls

Although system access controls can provide complete authentication, authorization, and accountability, they’re renowned for authentication. You can base authentication on any of three factors: Something you know, something you have, something you are.

Something you know is normally a password or secret PIN that is used to access a system. Usernames and passwords are the simplest and cheapest way to secure a system but is not the most secure.

Something you have can be a smart card or a token. This concept is based on the assumption that only the owner of the account has the necessary key to unlock the account.

Something you are such as fingerprint, voice, retina, or iris characteristics. This is the most secure form of authentication because it goes under the assumption that only you have access to your eyeball or hand. Biometric systems are some of the most expensive and complicated to implement which makes them rare to see in implementation.

Two-factor authentication requires two of these three authentication factors for authentication. Three-factor authentication requires all three factors for authentication. A commonly cited example of an access control system that uses two-factor authentication is an automatic teller machine (ATM) card and a PIN.

Identification and Authentication

The identification component is normally a relatively simple mechanism based on a username. Identification requirements include only that it must uniquely identify the user (or system/process) and shouldn’t identify that user’s role or relative importance in the organization. Common or shared accounts, such as root, admin, or system should not be permitted. These accounts provide no accountability and are prime targets for Hackers. Passwords are easily the most common and weakest authentication mechanism in use today. Although there are more advanced and secure authentication technologies available, including tokens and biometrics, organizations typically use those technologies as supplements to or in combination with rather than as replacements for traditional usernames and passwords.

A passphrase is a variation on a password; it uses a sequence of characters or words, rather than a single password. Generally, attackers have more difficulty breaking passphrases than breaking regular passwords because longer passphrases are generally more difficult to break than complex passwords. Passphrases also have the following advantages:

·         Users frequently use the same passwords to access numerous accounts; their corporate networks, their home PCs, their e-mail accounts. An attacker who targets a specific user may be able to gain access to his or her work account by going after a less secure system, such as his or her home PC, or by compromising an Internet. Internet sites and home PCs typically don’t use passphrases, so you improve the chances that your users have to use different passwords/passphrases to access their work accounts.

·         Users can actually remember and type passphrases more easily than they can remember and type a much shorter, cryptic password that is more difficult to type.

Passphrases also have a downside:

·         Users can find passphrases inconvenient, so you may find passphrases difficult to implement.

·         Many command-line interfaces and tools don’t support the space character that separates words in a passphrase.

·         A passphrase is still just a password and shares some of the same problems associated with passwords.