Access Control

A big part of identity and access management is access control. Access control is controlling the access to our resources, to our assets. What we want to do is guard our networks, our data, our different services. We want to guard them and only allow certain people, only allow authorized people, to access that information.

There's kind of three spokes to this, three different ways of looking at this. One is the physical aspects: how physically can people get to that data? Are your servers locked up? Are they behind fences? Are they behind gates? Are there security guards? Are there surveillance cameras? How physically have you controlled access to those servers that are running those services or storing that data?

Then we have the logical perspective. Most likely, most of your data is going to be accessible through some sort of network share or some sort of data sharing technique. So what are the permissions, what are the access control lists, what's standing in the way from an electronic standpoint to make sure only authorized people have access to those resources?

Then there's the administrative perspective of this. Those are the policies, the procedures, the things that we put in place to make sure that we have control over, and only authorized people can gain access to, our assets and our resources.

Permissions and access control lists

One way we control access to our different resources is through something called permissions. This is the idea that we are going to safeguard and put barriers, put up protections, put up logical barriers into our resources, but we're only going to give permissions to certain people to gain access to certain resources. So the permissions is what sets up the ability for certain people to access certain resources.

Permissions are set up in an access control list. An access control list is a list of access controls, so there'll be certain rules or certain permissions inside this access control to monitor, or to be able to control, the access to these different resources. For instance, let's say I wanted to give permission to a certain user into this database right here. This database has an access control list, and I would give that user permission to get into that database. Or perhaps that permission is for a group to get into it, or perhaps that permission is for some sort of object, some other object, to gain access to that, like a server to gain access to that database.

NTFS permissions

Here I am on a Windows machine, and I'm going to actually show you an access control list and some permissions. I'm going to show you actually two different examples of access control lists. The first access control list is going to be the NTFS permissions.

I'm going to just click on any folder here, right click on it and say Properties, and under here I have a Security tab. So I'm going to click the Security tab. This is the set of permissions. If you notice, I can select the different groups here or the different users. So this is a system group right here, and when I have it selected, this system has access to all of this. So this is essentially giving permission to the system, to the computer, to have access to this folder. I can see that demo laptop is a user that has the full rights into this folder as well, and then administrators as well.

Now let's say I wanted to change the permission level here, or grant somebody access to the permission. I'm going to click on Edit, I'm going to Add, and I'm going to add a user account I created named Andrew. So I'll click on this, and I just hit Check Name for it to recognize my name, and now there it is, that's the user that's on this laptop. I'm going to click on OK, and then I can select the level of permissions that I want to grant this specific user, or if I want to deny them access to something I can do that as well. So I'm going to grant modify rights and I'm going to leave out full rights, and so that looks pretty good right there, and now I can hit Apply.

Or there are groups on here also. I have a demo group, so I'm going to type in demo group, click Check Name, and there's the group. I'm going to add that, and now the demo group is on there. So then I give access to this demo group, and perhaps I want to grant full control. So this is an example of NTFS permissions on here, and this is the access control list for this particular folder, this resource.

An access control list on a router

The other one that I'll show you is going to be an access control list on a router. This would be similar to what you would see on a firewall. So I'm going to bring up a router right here, and I pulled up a command to pull up the access control list. For this particular one, ICMP is ping packets. So what it's doing is it's permitting pinging from this particular host right here. Then it denies anything else from that network, and then it will allow any other type of traffic to go across here.

So this is an access control list that is controlling the access to a network. The first one I showed you was controlling access to a folder on my desktop, and this one's controlling access through this router, so it's controlling it from one destination to another.

How different access control lists behave

Now, depending on what the access control is and what kind of technology it's being used on, these access control lists will actually behave a little differently. The behaviors are going to be quite a bit different, actually. For instance, this access list on this router right here: all the traffic that's going through it is going to measure up against this first statement right here, and if it happens to belong to host 102.05, then it's going to permit that traffic and it's not going to continue to access any of these other statements here. But if it doesn't, then it will try to measure up against the next one and then the next one, and it'll keep doing that until it finds the one that matches.

So that is for a firewall or a router. But these NTFS permissions here, they stack. So if I get a certain set of permissions through my user account Andrew, and then another set of permissions through the group that's called demo group, they're going to be additive, so they're going to group together. Just realize that the way these different access lists behave is quite a bit different.

Implicit versus explicit

One example of these behaviors that are going to be a little different depending on what ACL you're working with is this idea of implicit versus explicit. Implicit means that it doesn't need to be defined; that's going to be the behavior, and so it doesn't have to be defined. Versus explicit, which means that it has to be defined.

An example of this is if a computer is trying to talk out to the internet and going through a firewall. There's a direction that happens here for this computer to talk out to the internet. So going from inside your network to outside, the outside is considered untrustworthy versus the inside is considered trustworthy. What's going to happen is that there is this implicit "I'm going to allow traffic to go from in to out." So there's this implicit allow, and if you want to block something off, then you're going to have to set up an explicit "I am going to block certain things from being able to go out."

Now reverse: we don't want something from the outside that's untrusted to be able to just get into our network. So there is an implicit deny that's going to happen, that I'm not going to allow traffic from the outside to get inside unless I explicitly allow it. So in these firewall access lists there's an implicit deny all, and it says I'm going to just deny it unless I specifically am told no, allow this to come back into the network.

Least privilege

There's this idea of least privilege, and the idea behind least privilege is that we give the least amount of permission into resources for somebody to be able to do their job.

A good example of that is a CEO. A CEO is the head of some sort of corporation, the chief executive officer, so they are in charge of the whole company. It might immediately think, well, maybe we should give that person access to the whole company, all of the different resources. But no, least privilege says we shouldn't do that, and the reason why is because if this person's account ever got compromised, they get access to everything that that person has access to.

Let's say that person needs access to maybe some server, maybe some data, some different resources there, but we accidentally gave this person access to admin rights into the switch and to all of the different machines and the backend database and all the keys to everything. The CEO is a high target within a company, so let's say their account gets compromised, and now suddenly the person that hacked this account and has gained access has access to stuff that they shouldn't really have access to. So we really want to limit this by least privilege, giving them the least amount of permissions into those resources as possible.