1. Conferencia FIST Mayo/Madrid 2008 @
Sponsored by:
Access Control Management
Vicente Aceituno, 2008

2. About me
Vice president of the ISSA Spain chapter.
www.issa-spain.org
Vice president of the FIST Conferences
association.
www.fistconference.org
Author of a number of articles:
Google: vaceituno wikipedia
Director of the ISM3 Consortium
The consortium promotes ISM3, an ISMS standard
www.ism3.com
2

3. The other side
3

4. Access Control
Authentication
Authorization
Auditing
Enough?
4

5. Yes…questions
User Account vs User
Credential
ID.
Information about the user.
Proof of:
Ownership: Password vs Criptographic Key
Personality: Human? Older than 18? A Woman?
From Barcelona?
5

6. Authentication
Proofs of identity, personality and
ownership:
What I know: Passwords
What I have: Tokens
What I am: Eyes, Fingerprints, etc
What I like:
What I can do: Maths in German anyone?
What I think: (values)
6

7. Authorization
Permission of access to resources
Credential x Resources x Actions
7

8. The hidden side
Authentication: Real Time Authentication
of Credentials vs Granting and Delivery of
Credentials to People.
Proof of Identity, or Are you who you were?
Proof of Personality.
Authorization: Real Time Access Grant vs
Granting Access Rights to Credentials.
8

9. Session
Work session between user and
application
Session between processes
TCP Transmission session
Frame transmission session
su (nested session)
Software agent session
WAP2 session
etc…
9

10. Session – User Account
H
H
10

11. Session - Certificate
H
H
H X Y
11

12. Access Control Management
12

13. Access Control Management
H
H
13

14. Auditing
Logs
Check ELML
14

15. ELML Markup
Every event can have an eventID.
If the event is not logged by the agent of the
event, the logger can be identified using a
loggerID.
The agent of the event can be identified using a
sourceID.
The agent of the event can stay in different
locations, identified using a addressID.
The credential used by the source to perform a
request can be identified using a credentialID.
The resource (subject) of the event is identified
using a resourceID.
15

16. ELML Markup
The request (access attempt) performed has a
RequestType and a Result. The reason for the
Result is stated in the ResultText.
The payload contains the information necessary
to perform the request.
dateTime is the date and time when the request is
performed.
signature is the digital signature of the event using
the credentialID.
hash is the digital summary of the event. It is
recommended that the hash of the previous event
in the Record is used to calculate it.
16

17. ELML Vocabulary
Component Initiate Finalize Freeze Unfreeze Query Change
State State
Credential create delete block unblock read write
Session login logout suspend resume read write
Message send listen retain forward read write
Repository create delete block unblock read write
Interface connect disconnect interrupt continue read write
Channel open close hold release read write
Service start stop pause resume read write
17

18. Multiple Credentials
18

19. Challenges
eDNI
Weak Passwords / Authentication
Identification vs Anonimity
Privacy vs Marketing
DRM
Physical Access
SSO
Password Synchronization
Logs Standarization
Expiry
Minimum Privilege
Work Role – Access Rights Synchronization
Identifiying Systems -> Phising
19

20. Access Control
http://identity20.com/media/OSCON2005/
http://www.cerias.purdue.edu/weblogs/spa
f/general/post-30/
20

21. Access Control
Identification
Authentication
Access Granting
Authorization
Auditing
21

22. Access Control
22

23. Creative Commons
Attribution-NoDerivs 2.0
You are free:
•to copy, distribute, display, and perform this work
Under the following conditions:
Attribution. You must give the original author credit.
No Derivative Works. You may not alter, transform, or build upon this
work.
For any reuse or distribution, you must make clear to others the license terms of this work.
Any of these conditions can be waived if you get permission from the author.
Your fair use and other rights are in no way affected by the above.
This work is licensed under the Creative Commons Attribution-NoDerivs License. To view a copy of
this license, visit http://creativecommons.org/licenses/by-nd/2.0/ or send a letter to Creative
Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA.
23

24. @ with the sponsorship of:
THANK YOU
24
www.fistconference.org