In this section of the course,
we are going to discuss Access, Authentication,
and Authorization.
The Access, Authentication, and Authorization section
of the course focuses on Domain 2: Security Architecture,
specifically objective 2.4,
which states that given a scenario,
you must be able to apply security
to the design of access, authentication,
and authorization system.
To keep systems and data safe,
it's important to carefully manage
who can access different parts of the system.
This involves ensuring
that users are assigned privileges
based on their role within the organization,
following a verification of their identity.
Additionally, regularly monitoring
and overseeing access activities
ensures sensitive information remains protected,
and that access remains in accordance
with organizational security policies.
As we go through this section,
we will cover many topics related to Access, Authentication,
and Authorization,
including Access Control Systems,
Access Provision,
Rule-based Access Control,
Role-based Access Control or RBAC,
Identity and Authentication, Access Control Policies,
and Monitoring and Oversight.
First, we will look at Access Control Systems.
Access control systems are mechanisms designed to ensure
that only authorized individuals can access resources
and information based on their identity and permissions.
Access control systems may be classified as either physical
or logical control systems.
Physical access control systems manage the entry
to physical locations, such as buildings or a server room,
using methods such as Radio Frequency Identification,
or RFID key cards,
or biometric scanners.
Logical access control systems manage digital access
to enterprise networks using passwords
or multifactor authentication to verify user identity
and enforce permissions for access to network resources.
Next, we will explore Access Provision.
Access provision is the process of granting
or revoking access rights to resources based on user roles
and their associated permissions.
Access provision concepts include provisioning,
deprovisioning, self-provisioning, and credential issuance.
Provisioning is assigning access rights
and credentials to users based on their roles.
Provisioning assignment may be automated
through self-provisioning systems where users request access
and receive it upon administrator approval.
Deprovisioning involves removing access rights
when they are no longer needed,
such as when an employee leaves the organization.
Credential issuance is the process of creating
and distributing authentication credentials,
such as passwords or security tokens,
which can be used in user authentication.
For example,
a new employee might use a self-provisioning portal
to request access to company systems,
receive credentials through the credential issuance process,
and at the end of their employment with that organization,
have their access revoked via a deprovisioning process.
After that, we will look at Rule-based Access Control.
Rule-based access control is used to manage user access
to resources based on predefined rules and conditions.
An example of a rule-based access control model
is Mandatory Access Control or MAC.
Mandatory access control enforces strict access policies
based on predefined security classifications.
This limits user access
based on the classification of information,
and the user's clearance level.
Other access control models
include Discretionary Access Control or DAC,
and Attribute-based Access Control or ABAC.
Discretionary Access Control
allows resource owners full control of resource access,
enabling them to grant or deny access to their resources.
Attribute-based Access Control uses attributes of users,
resources, and the environment
to determine access permissions dynamically.
For example, in a healthcare setting,
Attribute-based Access Control may provide access
to patient records based on attributes like the user's role,
such as a doctor or a nurse.
It can also grant access based on the type
of patient data requested,
and contextual factors like the time of day.
In this situation, a nurse might access basic information
during regular working hours,
while a doctor may view sensitive data
if it's during their shift, regardless of the time of day.
Next, we will explore Role-based
Access Control or RBAC.
Role-based Access Control manages user access
by assigning permissions
based on the user's role within the organization.
Role-based Access Control is implemented
by defining roles within an organization,
and associating specific permissions with each role.
Users are then assigned to roles,
and their access rights are inherited
from the role they are assigned to.
Following that, we will look at identity and authentication.
Identity and authentication
involves verifying a user's identity
to ensure they're authorized to access resources
and perform actions.
Identity and authentication controls include attestations,
single sign-on, federation, identity providers,
and service providers.
Let's take a moment to explore each of these concepts.
Attestations confirm that a user
or system meets certain security requirements
or policies before access is granted.
Single Sign-on or SSO, allows users
to authenticate one time
and gain access to multiple resources
and services without having to re-authenticate.
Federation enables different organizations
or domains to share authentication information
and trust each other's identity assertions.
It often uses an Identity Provider to authenticate users
to a service provider
to grant access based on that authentication.
For example, when signing into a third-party application,
like a project management tool using a Google account,
federation allows the application
to trust Google's authentication process.
Google then acts as the identity provider
to verify credentials
and provide an attestation through a secure token
to the application,
which then grants access based on the verified identity.
Next, we will explore Access Control Policies.
Access control policies define the rules
and criteria for granting
or denying access to resources,
ensuring that only authorized users can perform actions
based on their identity and role.
Access control policy concepts include conditional accesses,
as well as policy decision and enforcement points.
Let's take a moment to dive further into these concepts.
Conditional Access involves enforcing access policies
based on specific conditions, such as the user's location,
device type, or time of access.
Policy Decision Points
evaluate whether access requests meet defined policies,
while Policy Enforcement Points
enforce policy decision point decisions by granting
or denying access.
For example, a company might use conditional access
to restrict access
to sensitive financial systems
based on whether users are connecting
from within the corporate network
or using a remote secure device.
In this scenario,
policy decision points evaluate the access request,
and policy enforcement points implement the decision
by granting or blocking access based on the assessment
of policy condition.
Finally, we will look at Monitoring and Oversight.
Monitoring and oversight is continuously tracking
and reviewing access, authentication,
and authorization activities to ensure compliance
with security policies
and to detect any unauthorized or anomalous behavior.
Monitoring and oversight concepts include logging
and auditing.
Logging captures detailed records of access
and authentication events,
such as successful logins or access attempts.
The logs are then used to track user activities,
and for troubleshooting.
Auditing involves analyzing logs to assess compliance
with security policies,
and identify potential security breaches
or policy violations.
For example, a company might log all user access
to sensitive systems,
and audit logs to ensure
that access is only granted according to approved policies.
This type of auditing would allow the organization
to detect suspicious activities.
To finish things off, we'll take a short quiz
to see what you learned during this section of the course,
and we will review each of those quiz questions
to fully ensure you can explain
why the right answers were right
and the wrong answers were wrong.
So, let's get ready to dive into Access, Authentication,
and Authorization in this section of the course!