Access Control

Question 1

What are the Access control categories?

Answer 1

• Preventive: prevents actions. For example, background check before approving a tenant.
• Detective: Sends alert during or after an attack. Like a network Intrusion Detection System(IDS) alerts network administrator of an attack.
• Corrective: “correct” a damaged system or process. Like an anti-virus can quarantine and delete malicious software from a computer system or Intrusion Prevention System(IPS) can stop a network attack by blocking it.
• Recovery: are for restoring functionality like restoring corrupted data with backup.
• Deterrent: deter users from performing actions like a “beware of dog” sign.
• Compensation: add additional security like defense in depth or multiple layers of security.

Question 2

Access Control Models

Answer 2

1. Mandatory Access Control.
2. Discretionary Access Control.
3. Role and Rule Based Access Control.

Question 3

The Bell-LaPadula Model

Answer 3

Implements a combination of discretionary and mandatory access controls(DAC and MAC) and is primarily concerned with the confidentiality of the resource in question. In other words, making sure unauthorized people can’t read it. MAC precedes DAC. Two security properties define how information can flow:
* The Simple Security Property: The level of access to an individual must be as high as the classification of the resource in order for the individual to access it.
* The * Property(Star Property): Anyone accessing a resource can only write(or copy) its contents to another resource classified at the same level or higher.

Question 4

The Biba Model

Answer 4

The Biba model of access control is primarily concerned with protecting the integrity of data, even at the expense of confidentiality. It has two security rules:
* The Simple Integrity Axiom: The lvel of access granted to an individual must be no lower than the classification of the resource.
* The * Integrity Axiom: Anyone accessing a resource can only write its contents to a resource classified at the same level or lower.

Question 5

The Brewer and Nash Model

Answer 5

The Brewer and Nash model AKA Chinese Wall is an access control model designed to prevent conflicts of interest. This model is commonly used in industries that handle sensitive data such as the financial, medical, or legal industries.
This model considers three main resource classes:
* Objects: Resources, such as files, information
* Company Groups: All objects pertaining to an organization.
* Conflict Classes: All groups of objects concerning competing parties.

Question 6

Cross-Site Request Forgery

Question 7

Clickjacking