IAM - Access Control

A big part of identity and access management is access control.

What Access Control Is

Access control is controlling the access to our resources, to our assets. What we want to do is guard our networks, our data, our different services. We want to guard them and only allow certain people, only allow authorized people, to access that information.

There's kind of three spokes to this, three different ways of looking at this. One is the physical aspects: how physically can people get to that data? Are your servers locked up? Are they behind fences, are they behind gates, are there security guards, are there surveillance cameras? How physically have you controlled access to those servers that are running those services or storing that data?

Then we have the logical perspective. Most likely most of your data is going to be accessible through some sort of network share or some sort of data sharing technique, and so what are the permissions, what are the access control lists, what's standing in the way from an electronic standpoint to make sure only authorized people have access to those resources?

Then there's the administrative perspective of this. Those are the policies, the procedures, the things that we put in place to make sure that we have control over our assets and our resources, and that only authorized people can gain access to them.

Permissions

One way we control access to our different resources is through something called permissions. This is the idea that we are going to safeguard and put barriers up, put up protections, put up logical barriers into our resources, but we're only going to give permissions to certain people to gain access to certain resources. So the permissions is what sets up the ability for certain people to access certain resources.

Access Control Lists

Permissions are set up in an access control list. An access control list is a list of access controls, so there'll be certain rules or certain permissions inside this access control to monitor, or to be able to control, the access to these different resources.

For instance, let's say I wanted to give permission to a certain user into this database right here. This database has an access control list, and I would give that user permission to get into that database. Or perhaps that permission is for a group to get into it, or perhaps that permission is for some other object to gain access to that, like a server to gain access to that database.

Here I am on a Windows machine. I'm going to actually show you an access control list and some permissions. I'm going to show you two different examples of access control lists.

The first access control list is going to be the NTFS permissions. I'm going to just click on any folder here, right click on it and say properties, and under here I have a security tab, so I'm going to click the security tab. This is the set of permissions. If you notice, I can select the different groups here or the different users. This is a system group right here, and when I have it selected, this system has access to all of this, so this is essentially giving permission to the system, to the computer, to have access to this folder. I can see that demo laptop is a user that has the full rights into this folder as well, and then administrators as well.

Now let's say I want to change the permission level here, or grant somebody access to the permission. I'm going to click on edit, I'm going to add, and I created a user account named Andrew, so I'll click on this and I just hit check name for it to recognize my name. So now there it is, that's the user that's on this laptop. I'm going to click on okay, and then I can select the level of permissions that I want to grant this specific user, or if I want to deny them access to something I can do that as well. I'm going to grant modify rights and I'm going to leave out full rights, and so that looks pretty good right there, and now I can hit apply.

There are groups on here also. I have a demo group, so I'm going to type in demo group, click check name, and there's the group. I'm going to add that, and now the demo group is on there. Then I give access to this demo group, and perhaps I want to grant full control. So this is an example of NTFS permissions on here, and this is the access control list for this particular folder, this resource.

The other one that I'll show you is going to be an access control list on a router. This would be similar to what you would see on a firewall. This is a router right here, and I pulled up a command to pull up the access control list. For this particular one, ICMP is ping packets, so what it's doing is it's permitting pinging from this particular host right here. Then it denies anything else from that network, and then it will allow any other type of traffic to go across here. So this is an access control list that is controlling the access to a network. The first one I showed you was controlling access to a folder on my desktop, and this one's controlling access through this router, so it's controlling it from one destination to another.

Access Control List Behaviors

Now depending on what the access control is and what kind of technology it's being used on, these access controls will actually behave a little differently. The behaviors are going to be quite a bit different, actually. For instance, this access list on this router right here: all the traffic that's going through it is going to measure up against this first statement right here, and if it happens to belong to host 102.05 then it's going to permit that traffic and it's not going to continue to access any of these other statements here. But if it doesn't, then it will try to measure up against the next one, and then the next one, and it'll keep doing that until it finds the one that matches.

All right, so that is for a firewall or a router. But these NTFS permissions here, they stack. So if I get a certain set of permissions through my user account Andrew and then another set of permissions through the group that's called demo group, they're going to be additive, so they're going to group together. So just realize that the way these different access lists behave is quite a bit different.

Implicit Versus Explicit

One example of these behaviors that are going to be a little different depending on what ACL you're working with is this idea of implicit versus explicit. Implicit means that it doesn't need to be defined, that's going to be the behavior, so it doesn't have to be defined, versus explicit, which means that it has to be defined.

An example of this is if a computer is trying to talk out to the internet and going through a firewall. There's a direction that happens here for this computer to talk out to the internet. Going from inside your network to outside, the outside is considered untrustworthy, versus the inside is considered trustworthy. So what's going to happen is that there is this implicit allow for traffic to go from in to out. There's this implicit allow, and if you want to block something off then you're going to have to set up an explicit rule that says I am going to block certain things from being able to go out.

Now in reverse, we don't want something from the outside that's untrusted to be able to just get into our network, so there is an implicit deny that's going to happen, that I'm not going to allow traffic from the outside to get inside unless I explicitly allow it. So in these firewall access lists there's an implicit deny all that says I'm going to just deny it unless I specifically am told to allow this to come back into the network.

Least Privilege

There's this idea of least privilege, and the idea behind least privilege is that we give the least amount of permission into resources for somebody to be able to do their job.

A good example of that is a CEO. A CEO is the head of some sort of corporation, the chief executive officer, so they are in charge of the whole company. You might immediately think, well, maybe we should give that person access to the whole company, all of the different resources. But no, least privilege says we shouldn't do that, and the reason why is because if this person's account ever got compromised, they get access to everything that that person has access to.

So let's say that person needs access to maybe some server, maybe some data, some different resources there, but we accidentally gave this person access to admin rights into the switch and to all of the different machines and the backend database and all the keys to everything. Now the CEO is a high target within a company, so let's say their account gets compromised, and now the person that hacked this account and has gained access has access to stuff that they shouldn't really have access to. So we really want to limit this by least privilege, giving them the least amount of permissions into those resources as possible.

Just in Time Permissions

Along with least privilege, we don't want to give them access to certain resources for too long either. For instance, that CEO: maybe for some reason they do need to have some sort of access, some sort of key access, maybe it's some sort of database access that they wouldn't typically have, but they just need to run some reports. They don't want to outsource it, it's something that's private that they want to be able to figure out some information on. So that CEO may gain temporary access into certain resources, pull those reports, and then we would cut that access off. So it's just in time permissions, that we only give them permissions during the period of time that they need permissions for.

This is really common if you have like a contractor come in. Let's say I want a contractor to come in and do work on our network. Typically I wouldn't allow outside people to gain access into our network, but let's say this contractor needs access to certain resources; then we give them access just for the duration of that contract.

Ephemeral Credentials

Very closely related to this is ephemeral credentials. That's where we set up an account specifically for somebody like a contractor who only needs an account for a certain period of time. So this ephemeral is just temporarily giving somebody an account so they get access to certain resources, can do their work, and then we take away those credentials, we take away those accounts once they're done.