Access Control

Access Control

1. Type of controls

   • Administrative Control o Management control
     • Administrative Control o Management control
   • Logical control o Tecnical Control
   • Physical control
   • Operational Control

2. Classes of controls

   • Preventive
   • Corrective
   • Detective
   • Deterrent
   • Compensating

3. False Positives/False Negatives

   • False Positives
   • False Negatives

4. Implicit Deny

5. Least Privilege

6. Separation of Duties

7. Job Rotation

8. Other Account Practices

   • Onboarding
   • Offboarding
   • Recertification
   • Standard naming convention
   • Account maintenance
   • Location-based policies

9. Access Control Models

   • Discretionary Access Control
   • Mandatory Access Control
     • Nivel de autorización (Usuarios o grupos)
       • Top secret
       • Secret
       • Confidential
       • Restricted
       • Unclassified
     • Etiquetas (Fichero)
       • Confidential
       • Private
       • Sensitive
       • Public
   • Role-Based Access Control (RBAC)
   • Rule-Based Access Control (RBAC)
   • Group-Based Access Control (GBAC)
   • Attribute-Based Access Control (ABAC)
   • User Account Types
     • User account:
     • Shared and generic accounts
     • Guest accounts
     • Service accounts
     • Privileged accounts:
   • Using Security Groups
   • Rights and Privileges
     • Access this computer from the network
     • Allow log on locally
     • Back up files and directories
     • Change the system time
     • Take ownership of files or other objects
   • NTFS Permissions
     • Read
     • Modify
     • Full Control
   • Linux Permissions
     • Read (R): 4
     • Write (W): 2
     • Execute (X): 1
   • Access Control Lists (ACLs)
     • Cisco Standard Access Lists
     • Cisco Extended Access Lists
   • Group Policies
     • Install software
     • Configure password policies
     • Configure auditing
     • Configure user rights
     • Restricted groups
     • Disable services and configure event logs
     • File system permissions
     • Software restrictions:
     • Lock down the system by disabling features
   • Different types of group policies
     • 1º - Local
     • 2º - Site:
     • 3º - Domain
     • 4º - Organization unit (OU)
   • Database Security
     • Roles
     • Permissions
     • Encryption
     • Auditing
   • Account Restrictions
     • Account Expiration
     • Time-of-Day Restrictions:
     • Account Lockout:
       • Account lockout threshold
       • Account lockout duration
       • Reset account lockout counter after
     • Account Disablement:
     • View Account Details:
   • Account Policy Enforcement
     • Shared accounts
     • Credential management
     • Group policy
     • Password complexity:
     • Expiration
     • Recovery
     • Disablement
     • Lockout
     • Password history
     • Password reuse
     • Password length
     • Generic account prohibition
   • Monitoring Account Access
     • Group-based privileges
     • User-assigned privileges
     • User access reviews
     • Continuous monitoring