Access Control 2 - intermediary controls

Access Control 2 - intermediary controls

1. Intermediate Controls

   • Groups
     • users with similar access rights collected in groups
     • Given permissions to access objects

2. Negative Permission

   • operation user cant do
   • policy conflict - resolved by reference monitor

3. Priviliges

   • collection of rights to execute certain operations
   • avtivities such as admin, back up and network access

4. Role Based Access Control

   • Priviliges come predefined with OS
   • Role
     • Collection of application specific operations
   • Subjects derive access rights from their role - admin etc

5. Roles and Layers

   • Layers between subject & objects
   • Roles
     • Collection of procedures, assigned to users
   • Procedures
     • High level access control methods

6. Evaluating Security Policies

   • Most basic: check against ACE - Access Control Entry
     • Andrew Cant Eat
   • Protection Rings
     • hardware based access control
     • each subject and object are assigned a number depending on importance
     • Decision made by comparing subject and objects numbers
   • Partial Ordering
     • student group + year group for example
     • partial orderings provide relations between subsets
     • Security policy: grant access if object label <= subject label
   • Multi-level security
     • access to info should only be granted if it is necessary to perform ones duties

7. sandboxing

   • run code in restricted environment ( JVM )
   • android sandboxing
     • app defined permissions
       • isolates your app data from other apps
     • app framework - with cryptography and robust implementation of permissions

8. Virtualisation

   • emulate other machines

9. Trusted computing

   • verifiable state of software/ hardware
   • Nexus

Images and files in the map