1. Access Control Systems &
Methodology
1

2. Topics to be covered
 Overview  Tokens/SSO
 Access control  Kerberos
implementation  Attacks/Vulnerabilities/Monitoring
 Types of access control  IDS
 MAC & DAC  Object reuse
 Orange Book  TEMPEST
 Authentication  RAS access control
 Passwords  Penetration Testing
 Biometrics
2

3. What is access control?
 Access control is the heart of security
 Definitions:
 The ability to allow only authorized users,
programs or processes system or resource access
 The granting or denying, according to a particular
security model, of certain permissions to access a
resource
 An entire set of procedures performed by
hardware, software and administrators, to monitor
access, identify users requesting access, record
access attempts, and grant or deny access based
on pre-established rules.
3

4. Access control nomenclature
 Authentication
 Process through which one proves and verifies
certain information
 Identification
 Process through which one ascertains the identity of
another person or entity
 Confidentiality
 Protection of private data from unauthorized viewing
 Integrity
 Data is not corrupted or modified in any unauthorized
manner
 Availability
 System is usable. Contrast with DoS.
4

5. How can AC be implemented?
 Hardware
 Software

Application

Protocol (Kerberos, IPSec)
 Physical
 Logical (policies)
5

6. What does AC hope to protect?
 Data - Unauthorized viewing,
modification or copying
 System - Unauthorized use,
modification or denial of service
 It should be noted that nearly every
network operating system (NT, Unix,
Vines, NetWare) is based on a secure
physical infrastructure
6

7. Proactive access control
 Awareness training
 Background checks
 Separation of duties
 Split knowledge
 Policies
 Data classification
 Effective user registration
 Termination procedures
 Change control procedures
7

8. Physical access control
 Guards
 Locks
 Mantraps
 ID badges
 CCTV, sensors, alarms
 Biometrics
 Fences
 Card-key and tokens
 Guard dogs
8

9. AC & privacy issues
 Expectation of privacy
 Policies
 Monitoring activity, Internet usage, e-
mail
 Login banners should detail
expectations of privacy and state levels
of monitoring
9

10. Varied types of Access
Control
 Discretionary (DAC)
 Mandatory (MAC)
 Lattice/Role/Task
 Formal models:
 Biba
 Clark/Wilson
 Bell/LaPadula
 Used set theory to define the concept of a secure state,
the modes of access, and the rules for granting access.
10

11. Problems with formal models
 Based on a static infrastructure
 Defined and succinct policies
 These do not work in corporate systems
which are extremely dynamic and constantly
changing
 None of the previous models deals with:
 Viruses/active content
 Trojan horses
 firewalls
 Limited documentation on how to build these
systems 11

12. MAC vs. DAC
 Discretionary Access Control
 You decided how you want to protect and
share your data
 Mandatory Access Control
 The system decided how the data will be
shared
12

13. Mandatory Access Control
 Assigns sensitivity levels, labels
 Every object is given a sensitivity label & is accessible
only to users who are cleared up to that particular level.
 Only the administrators, not object owners, make change
the object level
 Generally more secure than DAC
 Orange book B-level
 Used in systems where security is critical, i.e., military
 Hard to program for and configure & implement
13

14. Mandatory Access Control
(Continued)
 Downgrade in performance
 Relies on the system to control access
 Example: If a file is classified as confidential,
MAC will prevent anyone from writing secret
or top secret information into that file.
 All output, i.e., print jobs, floppies, other
magnetic media must have be labeled as to
the sensitivity level
14

15. Discretionary Access Control
 Access is restricted based on the
authorization granted to the user
 Orange book C-level
 Prime use is to separate and protect users
from unauthorized data
 Used by Unix, NT, NetWare, Linux, Vines,
etc.
 Relies on the object owner to control access
15

16. Access control lists (ACL)
 A file used by the access control system to
determine who may access what programs
and files, in what method and at what time
 Different operating systems have different ACL
terms
 Types of access:
 Read/Write/Create/Execute/Modify/Delete/Rename
16

17. Orange Book
 DoD Trusted Computer System Evaluation
Criteria, DoD 5200.28-STD, 1983
 Provides the information needed to classify
systems (A,B,C,D), defining the degree of
trust that may be placed in them
 For stand-alone systems only
17

18. Orange book levels
 A - Verified protection
 A1
 Boeing SNS, Honeywell SCOMP
 B - MAC
 B1/B2/B3
 C - DAC
 C1/C2
 D - Minimal security. Systems that have been
evaluated, but failed
18

19. Bell-LaPadula
 Formal description of allowable paths of
information flow in a secure system
 Used to define security requirements for
systems handling data at different sensitivity
levels
 *-property - prevents write-down, by
preventing subjects with access to high level
data from writing the information to objects of
lower access
19

20. Bell-LaPadula
 Model defines secure state
 Access between subjects, objects in accordance
with specific security policy
 Model central to TCSEC (TCSEC is an
implementation of the Bell-LaPadula model)
 Bell-LaPadula model only applies to secrecy
of information
 identifies paths that could lead to inappropriate
disclosure
 the next model covers more . . .
20

21. Biba Integrity Model
 Biba model covers integrity levels, which are
analagous to sensitivity levels in Bell-
LaPadula
 Integrity levels cover inappropriate
modification of data
 Prevents unauthorized users from making
modifications (1st goal of integrity)
 Read Up, Write Down model - Subjects
cannot read objects of lesser integrity,
subjects cannot write to objects of higher
integrity
21

22. Clark & Wilson Model
 An Integrity Model, like Biba
 Addresses all 3 integrity goals
 Prevents unauthorized users from making
modifications
 Maintains internal and external consistency
 Prevents authorized users from making improper
modifications
 T - cannot be Tampered with while being
changed
 L - all changes must be Logged
 C - Integrity of data is Consistent 22

23. Clark & Wilson Model
 Proposes “Well Formed Transactions”
 perform steps in order
 perform exactly the steps listed
 authenticate the individuals who perform
the steps
 Calls for separation of duty
23

24. Problems with the Orange Book
 Based on an old model, Bell-LaPadula
 Stand alone, no way to network systems
 Systems take a long time (1-2 years) to
certify
 Any changes (hot fixes, service packs, patches)
break the certification
 Has not adapted to changes in client-server
and corporate computing
 Certification is expensive
 For the most part, not used outside of the
government sector 24

25. Red Book
 Used to extend the Orange Book to
networks
 Actually two works:
 Trusted Network Interpretation of the
TCSEC (NCSC-TG-005)
 Trusted Network Interpretation
Environments Guideline: Guidance for
Applying the Trusted Network
Interpretation (NCSC-TG-011)
25

26. Authentication
3 types of authentication:
Something you know - Password, PIN,
mother’s maiden name, passcode, fraternity
chant
Something you have - ATM card, smart card,
token, key, ID Badge, driver license, passport
Something you are - Fingerprint, voice scan,
iris scan, retina scan, DNA
26

27. Multi-factor authentication
2-factor authentication. To increase the level of
security, many systems will require a user to provide
2 of the 3 types of authentication.
ATM card + PIN
Credit card + signature
PIN + fingerprint
Username + Password (NetWare, Unix, NT
default)
3-factor authentication -- For highest security
Username + Password + Fingerprint
Username + Passcode + SecurID token
27

28. Problems with passwords
Insecure - Given the choice, people will choose easily
remembered and hence easily guessed passwords such as
names of relatives, pets, phone numbers, birthdays, hobbies,
etc.
Easily broken - Programs such as crack, SmartPass,
PWDUMP, NTCrack & l0phtcrack can easily decrypt Unix,
NetWare & NT passwords.
Dictionary attacks are only feasible because users choose
easily guessed passwords!
Inconvenient - In an attempt to improve security,
organizations often issue users with computer-generated
passwords that are difficult, if not impossible to remember
Repudiable - Unlike a written signature, when a transaction is
signed with only a password, there is no real proof as to the
identity of the individual that made the transaction
28

29. Classic password rules
 The best passwords are those that are both
easy to remember and hard to crack using a
dictionary attack. The best way to create
passwords that fulfill both criteria is to use two
small unrelated words or phonemes, ideally
with a special character or number. Good
examples would be hex7goop or -typetin
 Don’t use:
 common names, DOB, spouse, phone #, etc.
 word found in dictionaries
 password as a password
 systems defaults 29

30. Password management
 Configure system to use string passwords
 Set password time and lengths limits
 Limit unsuccessful logins
 Limit concurrent connections
 Enabled auditing
 How policies for password resets and
changes
 Use last login dates in banners
30

31. Password Attacks
 Brute force
 l0phtcrack
 Dictionary
 Crack
 John the Ripper
 Trojan horse login program
31

32. Biometrics
 Authenticating a user via human
characteristics
 Using measurable physical characteristics of
a person to prove their identification
 Fingerprint
 signature dynamics
 Iris
 retina
 voice
 face
 DNA, blood
32

33. Advantages of fingerprint-
based biometrics
Can’t be lent like a physical key or token and can’t be
forgotten like a password
Good compromise between ease of use, template
size, cost and accuracy
Fingerprint contains enough inherent variability to
enable unique identification even in very large
(millions of records) databases
Basically lasts forever
Makes network login & authentication effortless
33

34. Biometric Disadvantages
Still relatively expensive per user
Companies & products are often new &
immature
No common API or other standard
Some hesitancy for user acceptance
34

35. Biometric privacy issues
Tracking and surveillance - Ultimately, the
ability to track a person's movement from
hour to hour
Anonymity - Biometric links to databases
could dissolve much of our anonymity when
we travel and access services
Profiling - Compilation of transaction data
about a particular person that creates a
picture of that person's travels, preferences,
affiliations or beliefs
35

36. Practical biometric
applications
Network access control
Staff time and attendance tracking
Authorizing financial transactions
Government benefits distribution (Social Security, welfare,
etc.)
Verifying identities at point of sale
Using in conjunction with ATM , credit or smart cards
Controlling physical access to office buildings or homes
Protecting personal property
Prevent against kidnapping in schools, play areas, etc.
Protecting children from fatal gun accidents
36

37. Tokens
 Used to facilitate one-time passwords
 Physical card
 SecurID
 S/Key
 Smart card
 Access token
37

38. Single sign-on
 User has one password for all enterprise
systems and applications
 That way, one strong password can be
remembered and used
 All of a users accounts can be quickly created
on hire, deleted on dismissal
 Hard to implement and get working
 Kerberos, CA-Unicenter, Memco Proxima,
IntelliSoft SnareWorks, Tivoli Global Sign-On,
x.509
38

39. Kerberos
 Part of MIT’s Project Athena
 Kerberos is an authentication protocol
used for network wide authentication
 All software must be kerberized
 Tickets, authenticators, key distribution
center (KDC)
39

40. Kerberos roles
 KDC divided into Authentication Server
& Ticket Granting Server (TGS)
 Authentication Server - authentication
the identities of entities on the network
 TGS - Generates unique session keys
between two parties. Parties then use
these session keys for message
encryption
40

41. Kerberos authentication
 User must have an account on the KDC
 KDC must be a trusted server in a secured
location
 Shares a DES key with each user
 When a user want to access a host or
application, they request a ticket from the
KDC via klogin & generate an authenticator
that validates the tickets
 User provides ticket and authenticator to the
application, which processes them for validity
and will then grant access. 41

42. Problems with Kerberos
 Each piece of software must be kerberized
 Requires synchronized time clocks
 Relies on UDP which is often blocked by
many firewalls
 Kerberos v4 binds tickets to a single network
address for a hosts. Host with multiple NIC’s
will have problems using tickets
42

43. Attacks
 Passive attack - Monitor network traffic and then use
data obtained or perform a replay attack.
 Hard to detect
 Active attack - Attacker is actively trying to break-in.
 Exploit system vulnerabilities
 Spoofing
 Crypto attacks
 Denial of service (DoS) - Not so much an attempt to
gain access, rather to prevent system operation
 Smurf, SYN Flood, Ping of death
 Mail bombs
43

44. Vulnerabilities
 Physical
 Natural
 Floods, earthquakes, terrorists, power outage, lightning
 Hardware/Software
 Media
 Corrupt electronic media, stolen disk drives
 Emanation
 Communications
 Human
 Social engineering, disgruntled staff
44

45. Monitoring
 IDS
 Logs
 Audit trails
 Network tools
 Tivoli
 OpenView
45

46. Intrusion Detection Systems
 IDS monitors system or network for
attacks
 IDS engine has a library and set of
signatures that identify an attack
 Adds defense in depth
 Should be used in conjunction with a
system scanner (CyberCop, ISS ) for
maximum security
46

47. Object reuse
 Must ensure that magnetic media must not have any
remnance of previous data
 Also applies to buffers, cache and other memory
allocation
 Required at TCSEC B2/B3/A1 level
 Secure Deletion of Data from Magnetic and Solid-
State Memory,
 Objects must be declassified
 Magnetic media must be degaussed or have secure
overwrites
47

48. TEMPEST
 Electromagnetic emanations from keyboards, cables,
printers, modems, monitors and all electronic equipment.
With appropriate and sophisticated enough equipment,
data can be readable at a few hundred yards.
 TEMPEST certified equipment, which encases the
hardware into a tight, metal construct, shields the
electromagnetic emanations
 WANG Federal is the leading provider of TEMPEST
hardware
 TEMPEST hardware is extremely expensive and can only
be serviced by certified technicians
 Rooms & buildings can be TEMPEST-certified
 TEMPEST standards NACSEM 5100A NACSI 5004 are
classified documents 48

49. Banners
 Banners display at login or connection stating
that the system is for the exclusive use of
authorized users and that their activity may
be monitored
 Not foolproof, but a good start, especially
from a legal perspective
 Make sure that the banner does not reveal
system information, i.e., OS, version,
hardware, etc.
49

50. RAS access control
 RADIUS (Remote Authentication Dial-In User Service) -
client/server protocol & software that enables RAS to
communicate with a central server to authenticate dial-in
users & authorize their access to requested systems
 TACACS/TACACS+ (Terminal Access Controller Access
Control System) - Authentication protocol that allows a RAS
to forward a users logon password to an authentication
server. TACACS is an unencrypted protocol and therefore
less secure than the later TACACS+ and RADIUS protocols.
A later version of TACACS is XTACACS (Extended
TACACS).
50

51. Penetration Testing
 Basically Improving the Security of Your Site by
Breaking Into it, by Dan Farmer/Wietse Venema
 http://www.fish.com/security/admin-guide-to-
cracking.html
 Identifies weaknesses in Internet, Intranet,
Extranet, and RAS technologies
 Discovery and footprint analysis
 Exploitation
 Physical Security Assessment
 Social Engineering
51

52. Penetration Testing
 Attempt to identify vulnerabilities and gain access to
critical systems within organization
 Identifies and recommends corrective action for the
systemic problems which may help propagate these
vulnerabilities throughout an organization
 Assessments allow client to demonstrate the need for
additional security resources, by translating exiting
vulnerabilities into real life business risks
52

53. Rule of least privilege
 One of the most fundamental principles of infosec
 States that: Any object (user, administrator, program,
system) should have only the least privileges the object
needs to perform its assigned task, and no more.
 An AC system that grants users only those rights
necessary for them to perform their work
 Limits exposure to attacks and the damage an attack
can cause
 Physical security example: car ignition key vs. door key
53

54. Implementing least privilege
 Ensure that only a minimal set of users have
root access
 Don’t make a program run setuid to root if not
needed. Rather, make file group-writable to
some group and make the program run setgid
to that group, rather than setuid to root
 Don’t run insecure programs on the firewall or
other trusted host
54

55. Access Control Systems &
Methodology
Any questions?
Files graciously shared by Ben Rothke.
Reformatted and edited for Slide presentation
55