Access Contol

Functions

Idenitification

Identification is about who you are:"I am Santa Clause"

Authentication

Authentication is how you prove who you are:Authentication can be performed using passwords, tokens or biometrics or a combination of the three.

Authorization/Access Control

Authorization can be direct (person 1 has access to system 1) or it can be abstracted by roles and entitlements (the auditor role has a read-only entitlement on to all data and meta-data)

Roles

Profiles

Monitoring and Reporting

What

Data

Database

Application Contoled Access

Database Controled Access

Enterprise Controlled Access

Flat files

Classification

Classification is difficult for most users to understand and is, therefore, often neglected.Classification is essential for data protection.

Protected A

Protected B

Protected C

Classified

Secret

Top Secret

Unclassified

Information

Documents

Lists

Directory Service

Metadata

Applications

Functions

Screens

Facilities

Media

Tapes

Disk

Web-sites

Removable disk

Integrated Circuit Disk (thumb drives)

Devices

Servers

Workstations

Connectivity Devices(switches, etc.)

I/O devices

Storage

Mainframe

Phones

Desktop

Cell

Smartphone

Services

Critical

Non Critical

Threats

Internal

SabotagePassword sharingUnlocked sessionsUncontrolled access to logsPrivilleged access

External

Phishing attacksSpear-Phishing attacksSocial EngineeringDOS attacksSpoofingMan-in-the-middle attacks

Who

Users

Position

Status

Owners

Administrators

Super Users

Super Administrators

Clients

Anonymous

Identified

DSO

ATIP

Audit

IT Security

When

Time of Day

Day of Week

Pre/post employment

Where

Remote

Client facing

Employee facing

Partners

Internal

How

Governance

Mixed mode

Decentralized

Centralized

Processes

Policy

Least Priviledge Principal

Segregation of Duties

FIPS

Oversight

Anonymous vs known

Technology

Active Directory

PKI

ACLs

LDAP

Why

Privacy

Security

Compliance