Instructor: In this lesson,
we will learn about subject access control.
Subject access is the mechanism that determines
and enforces which subjects have access
to specific resources within a network environment.
Subjects are defined as users,
processes, devices, and services.
A user is an individual entity that requires
and receives access to resources.
Next, a process is an instance of a program
that requires permissions to perform operations
on behalf of a user or system function.
Next, a device is any physical
or virtual hardware that connects to the network.
Devices often require authentication
to ensure they are authorized to access resources.
Finally, a service is a system function
or application that operates continuously
in the background, providing users
the seamless machine interaction they expect.
Services manage tasks like processing data,
handling requests, and maintaining system performance,
all without requiring direct user intervention.
Services may also interact with other services,
devices or users and must be controlled
to prevent unauthorized access.
Let's learn more about subject access control
in relation to users, processes,
devices, and service subjects.
First we have users.
The users are individuals
or entities that need access to resources within a system,
for example,
an employee logging into a company's network to check email
or access files is considered a user.
Subject access control ensures that each user
has the correct permissions based on their
role, like an accountant having access
to financial records while a software developer does not,
this prevents unauthorized access
and keeps sensitive information secure
by only allowing users to see what they need for their jobs
and nothing else.
Second, we have processes.
Processes are instances of programs that run on behalf
of a user or system function.
For example, when you open a web browser
to check your email,
that web browser is a process running on your computer.
Processes often need specific permissions
to perform their tasks, such as accessing a file
or connecting to the internet.
Subject access control manages these permissions
to ensure that processes only perform actions
that are safe and necessary.
If a process tries to access data
or perform an action it is not authorized for,
access control prevents it protecting the system
from potential threats like malware.
Third, we have devices.
Devices include any physical
or virtual hardware that connects to the network,
such as laptops, smartphones, or virtual machines.
Devices must authenticate themselves
to confirm they are authorized to connect
and access resources.
For example, when you connect your work laptop
to the office wifi the device may need
to pass security checks to ensure it's up to date
and compliant with any company policies.
Subject access control helps by checking device credentials,
ensuring that only approved devices can access the network
and blocking unauthorized,
or potentially compromised devices.
Fourth and last, we have services.
Services are system functions
or applications that operate
and run continuously in the background.
Managing tasks like processing data,
handling user requests, or maintaining system performance.
Examples of services include email,
file sharing applications, or database management systems.
These services interact with users, devices,
and other services often without direct user involvement.
Subject access control regulates these interactions
by defining what each service can access
and what actions it can perform.
For instance, an email service might have permission
to send and receive messages,
but should not have direct access
to sensitive financial records.
So by controlling service access like this,
the system prevents unauthorized access
and helps maintain the integrity of operations.
So remember, subject access control
determines and enforces which subjects
have access to specific resources within a network
where subjects include users,
processes, devices, and services.
Subject access control insurers users only have
the permissions necessary for their rules,
preventing unauthorized access to sensitive information.
Next processes are instances of running programs
that are granted permissions to only perform their tasks.
Next devices include both physical
and virtual hardware That must authenticate
to prove it is authorized to connect
and access network resources.
Finally, services operate in the background
to manage tasks
and are controlled
to ensure they only access the resources necessary
for their functions,
protecting the system from unauthorized access.