SlideShare a Scribd company logo
95752:3-1
Access Control
95752:3-2
Access Control
• Two methods of information control:
– control access
– control use or comprehension
• Access Control Methods
– Network topology and services (later)
– Passwords/Authentication methods
– File Protection
95752:3-3
Authentication
• Four classic ways to authenticate:
1. something you know (passwords)
2. something you have (smartcard)
3. something you are (fingerprint)
4. something you do (usage signature)
• None of these is perfect
95752:3-4
Passwords
• Account - person using the system
• Username - Identity of account (public)
– limited characters, alphanumeric & special characters
– typically related to real name of user (not always), certain
names reserved
– unique on system
– fixed at account creation
• Passwords – Verification of identity (private)
– Less limited length and characters
– Fixed until changed
– Non-unique passwords – both users have bad password
• Many Multi-user Operating Systems have same
scheme
95752:3-5
Password Security
• Password security depends on ONLY
you knowing the password
– Secure selection
– Secure handling
– Secure storage
95752:3-6
Password Storage
• “trapdoor encrypted”
– scrambled in a way that cannot be unscrambled
– scrambling folds password over itself - lost bits
– different users with same password won’t have
same scrambled password
– login scrambles entered password and compares
against stored scrambled password
– original concept: since only scrambled passwords
are available, storage is secure (FALSE!)
• shimeall:kr1eWN8N2pyAA
95752:3-7
Password Attacks
• Easy to Hard
– Given password
– Grab password
– Generate password
– Guess password
95752:3-8
Given Password
• Look It Up
– Default passwords
– Posted passwords
• Ask for It (Social Engineering)
– As colleague
– As friend
– As administrator / authority
– As clueless & needy
• Countermeasures
– Education
– Reverse Social Engineering
– Locked accounts
– Other authentication
95752:3-9
Grab Password (locally)
• Physical proximity
– Shoulder surfing
– Countermeasures
• Education
• Exercises
• One-time passwords
• Program access
– Trojan Horse
– Perverted program
– Countermeasures
• Integrity checks
• Other authentication
95752:3-10
Under normal conditions, the
data in a packet transmitted
over the network is read
only by the destination system
to which it is addressed.
Router
Local Network Operation
95752:3-11
When a packet sniffer is
present, a copy of all packets
that pass by it on the network
are covertly captured.
Packet Sniffer
Executing
Router
Packet Sniffing
95752:3-12
Wide Area Network Operation
• Always Switched
– Circuit-Switched
– Packet-Switched
• Switch Settings determine route
• Choice Points: Routers
– Connect two or more networks
– Maintain information on best routes
– Exchange information with other routers
95752:3-13
Network Redirection
Intruders can fool routers
into sending traffic to
unauthorized locations
95752:3-14
Other Network Attacks
• Tapping
– Method depends on network medium
– Countermeasures:
• Encryption
• Physical protection & inspection
• Van Eck Radiation
– Current through wire: Radio waves
– Receiver tunes in on hosts/network
– Countermeasures:
• Encryption
• Distance
• Emission Control
95752:3-15
Generate Password
• Use a dictionary
• Requires: Scrambled password,
Encryption method & Large dictionary
• Password Cracking
– Natural language words and slang
– Backwards / Forwards / Punctuation and Numbers inserted
– Program: 27,000 passwords in approx 3 seconds (Pentium
II/133)
• Countermeasures
– Preventive strike (BEWARE)
– Password rules
– Other authentication
95752:3-16
Guess Password
• Use knowledge of user
– System information
– Personal information
– Occupation information
• Often combined with dictionary attack
• Countermeasures
– Password rules
– Other authentication
95752:3-17
Passwords on Many Machines
• One or Many?
– Ease of memorization vs. likelihood of writing
– Options:
• Secure stored passwords
• Network authentication method
• Algorithm for varying passwords
95752:3-18
Something You Have
• Convert logical security to physical security
– One-time pad
– Strip card / smart card
– Dongle
– Challenge-Response calculator
• Problems: Cost & token issuing/handling
• Advantages: Physical presence; hard to
hack
95752:3-19
Something You Are
• Biometrics: Measure physical characteristic
– Face geometry
– Hand geometry
– Fingerprint
– Voiceprint
– Retinal Scan
– Signature
• Advantages: Physical presence, not easily lost
• Disadvantages: Cost, Security, Variation,
Handicaps
95752:3-20
Authentication Summary
• Many different options available
• None perfect
• Combined solutions are possible
• Risk: assumption that other method will
protect weaknesses
• Overlapping design needed
95752:3-21
Computer Files
• File: almost every visible aspect of system
• Human names vs. Computer reference
• Information on files:
– Location
– Size
– Type
– Creation and access times
– Owner
– Protections
95752:3-22
File Protections
• File Permissions: grouped usage
– Owner, Collaborators and others
– Read, Write, Execute, etc. allowed
• Access Control Lists: who can do what
– Account name and permissions
• Syntax and Semantics depend on Operating
System
95752:3-23
Using File Permissions
• Be as restrictive as reasonable
• Use minimal permissions as defaults
• Enforce individual account usage
• Use directory permissions
“Something everyone owns, no one owns”
95752:3-24
Defeating File Permissions
• Physical access:
– Reboot under different Operating System
– Raw access
• Subvert applications
– Trojan Horses
– Direct corruption
– Virus
• Countermeasures:
– Physical protection
– Disk encryption
– Configuration Control
– Integrity checking

More Related Content

PPTX
ISBB_Chapter6.pptx
PPTX
Information Security
PPTX
Crypto passport authentication
PPTX
Crypto passport authentication
PPTX
Crypto passport authentication
PPTX
Crypto passport authentication
PPTX
Crypto passport authentication
PPTX
Crypto passport authentication
ISBB_Chapter6.pptx
Information Security
Crypto passport authentication
Crypto passport authentication
Crypto passport authentication
Crypto passport authentication
Crypto passport authentication
Crypto passport authentication

Similar to Understanding access control in computer security.ppt (20)

PPTX
Crypto passport authentication
PDF
Basics of Data Security and Cryptographic techniques
PPTX
Security Architectures and Models.pptx
PPT
9. Computer Ethics.ppt
PDF
Security Fundamentals
PDF
Security fundamentals
PPT
Seminar on ECommerce
PPT
20-security.ppt
PPTX
640-554 IT Certification and Career Paths
PDF
Security in computer systems fundamentals
PPT
OperatingSystem.ppt
PPT
OperatingSystem.ppt
PDF
Ericas-Security-Plus-Study-Guide
PPSX
Secure electronic transaction
PPTX
Kerberos Authentication Process In Windows
PPTX
security in is.pptx
PPTX
501 ch 10 cryptography
PPTX
INFORMATION AND CYBER SECURITY
PDF
18CS2005 Cryptography and Network Security
PPT
CS553_ST7_Ch21-NetworkSecurityhhhhggg.ppt
Crypto passport authentication
Basics of Data Security and Cryptographic techniques
Security Architectures and Models.pptx
9. Computer Ethics.ppt
Security Fundamentals
Security fundamentals
Seminar on ECommerce
20-security.ppt
640-554 IT Certification and Career Paths
Security in computer systems fundamentals
OperatingSystem.ppt
OperatingSystem.ppt
Ericas-Security-Plus-Study-Guide
Secure electronic transaction
Kerberos Authentication Process In Windows
security in is.pptx
501 ch 10 cryptography
INFORMATION AND CYBER SECURITY
18CS2005 Cryptography and Network Security
CS553_ST7_Ch21-NetworkSecurityhhhhggg.ppt
Ad

More from olisahchristopher (20)

PPT
Introduction to wireless lans_safari.ppt
PPT
Lect1-Algorithms-and-Flowchart-ppt (1).ppt
PPTX
artificialneuralnetwork-200611082546.pptx
PPT
An introduction to data_representation.ppt
PPT
A detailed overview of computer virus.ppt
PPT
Understanding logic design in digital electronics.ppt
PPT
An introduction to Vsat-Presentation-ppt.ppt
PPTX
Understanding the fundamentals of the internet.pptx
PPTX
AN INTRODUCTION TO COMPUTER SECURITY TECHNIQUES.pptx
PPTX
Number Systems in software engineering.pptx
PPTX
An introduction to Constructors and destructors in c++ .pptx
PPTX
The conquest of space for elementary.pptx
PPTX
Object Oriented Programming using c++.pptx
PPT
Concept of Boolean Algebra & logic gates
PPT
An introduction to floating point arithmetic.ppt
PPTX
An introduction to object-oriented programming.pptx
PPTX
UNDERSTANDING ADDRESSING MODES1 IN THE CPU.pptx
PPTX
Introduction to Addressing modes in computer memory.pptx
PPTX
An introduction to the central processing unit.pptx
PPTX
Historical development of computers.pptx
Introduction to wireless lans_safari.ppt
Lect1-Algorithms-and-Flowchart-ppt (1).ppt
artificialneuralnetwork-200611082546.pptx
An introduction to data_representation.ppt
A detailed overview of computer virus.ppt
Understanding logic design in digital electronics.ppt
An introduction to Vsat-Presentation-ppt.ppt
Understanding the fundamentals of the internet.pptx
AN INTRODUCTION TO COMPUTER SECURITY TECHNIQUES.pptx
Number Systems in software engineering.pptx
An introduction to Constructors and destructors in c++ .pptx
The conquest of space for elementary.pptx
Object Oriented Programming using c++.pptx
Concept of Boolean Algebra & logic gates
An introduction to floating point arithmetic.ppt
An introduction to object-oriented programming.pptx
UNDERSTANDING ADDRESSING MODES1 IN THE CPU.pptx
Introduction to Addressing modes in computer memory.pptx
An introduction to the central processing unit.pptx
Historical development of computers.pptx
Ad

Recently uploaded (20)

PPTX
Pharma ospi slides which help in ospi learning
PDF
BÀI TẬP BỔ TRỢ 4 KỸ NĂNG TIẾNG ANH 9 GLOBAL SUCCESS - CẢ NĂM - BÁM SÁT FORM Đ...
PPTX
IMMUNITY IMMUNITY refers to protection against infection, and the immune syst...
PDF
Module 4: Burden of Disease Tutorial Slides S2 2025
PDF
2.FourierTransform-ShortQuestionswithAnswers.pdf
PPTX
Renaissance Architecture: A Journey from Faith to Humanism
PPTX
Week 4 Term 3 Study Techniques revisited.pptx
PDF
Saundersa Comprehensive Review for the NCLEX-RN Examination.pdf
PDF
Anesthesia in Laparoscopic Surgery in India
PDF
Microbial disease of the cardiovascular and lymphatic systems
PPTX
BOWEL ELIMINATION FACTORS AFFECTING AND TYPES
PDF
STATICS OF THE RIGID BODIES Hibbelers.pdf
PPTX
Cell Types and Its function , kingdom of life
PDF
Pre independence Education in Inndia.pdf
PPTX
Pharmacology of Heart Failure /Pharmacotherapy of CHF
PDF
Business Ethics Teaching Materials for college
PDF
O7-L3 Supply Chain Operations - ICLT Program
PPTX
Introduction_to_Human_Anatomy_and_Physiology_for_B.Pharm.pptx
PPTX
The Healthy Child – Unit II | Child Health Nursing I | B.Sc Nursing 5th Semester
PPTX
PPH.pptx obstetrics and gynecology in nursing
Pharma ospi slides which help in ospi learning
BÀI TẬP BỔ TRỢ 4 KỸ NĂNG TIẾNG ANH 9 GLOBAL SUCCESS - CẢ NĂM - BÁM SÁT FORM Đ...
IMMUNITY IMMUNITY refers to protection against infection, and the immune syst...
Module 4: Burden of Disease Tutorial Slides S2 2025
2.FourierTransform-ShortQuestionswithAnswers.pdf
Renaissance Architecture: A Journey from Faith to Humanism
Week 4 Term 3 Study Techniques revisited.pptx
Saundersa Comprehensive Review for the NCLEX-RN Examination.pdf
Anesthesia in Laparoscopic Surgery in India
Microbial disease of the cardiovascular and lymphatic systems
BOWEL ELIMINATION FACTORS AFFECTING AND TYPES
STATICS OF THE RIGID BODIES Hibbelers.pdf
Cell Types and Its function , kingdom of life
Pre independence Education in Inndia.pdf
Pharmacology of Heart Failure /Pharmacotherapy of CHF
Business Ethics Teaching Materials for college
O7-L3 Supply Chain Operations - ICLT Program
Introduction_to_Human_Anatomy_and_Physiology_for_B.Pharm.pptx
The Healthy Child – Unit II | Child Health Nursing I | B.Sc Nursing 5th Semester
PPH.pptx obstetrics and gynecology in nursing

Understanding access control in computer security.ppt

  • 2. 95752:3-2 Access Control • Two methods of information control: – control access – control use or comprehension • Access Control Methods – Network topology and services (later) – Passwords/Authentication methods – File Protection
  • 3. 95752:3-3 Authentication • Four classic ways to authenticate: 1. something you know (passwords) 2. something you have (smartcard) 3. something you are (fingerprint) 4. something you do (usage signature) • None of these is perfect
  • 4. 95752:3-4 Passwords • Account - person using the system • Username - Identity of account (public) – limited characters, alphanumeric & special characters – typically related to real name of user (not always), certain names reserved – unique on system – fixed at account creation • Passwords – Verification of identity (private) – Less limited length and characters – Fixed until changed – Non-unique passwords – both users have bad password • Many Multi-user Operating Systems have same scheme
  • 5. 95752:3-5 Password Security • Password security depends on ONLY you knowing the password – Secure selection – Secure handling – Secure storage
  • 6. 95752:3-6 Password Storage • “trapdoor encrypted” – scrambled in a way that cannot be unscrambled – scrambling folds password over itself - lost bits – different users with same password won’t have same scrambled password – login scrambles entered password and compares against stored scrambled password – original concept: since only scrambled passwords are available, storage is secure (FALSE!) • shimeall:kr1eWN8N2pyAA
  • 7. 95752:3-7 Password Attacks • Easy to Hard – Given password – Grab password – Generate password – Guess password
  • 8. 95752:3-8 Given Password • Look It Up – Default passwords – Posted passwords • Ask for It (Social Engineering) – As colleague – As friend – As administrator / authority – As clueless & needy • Countermeasures – Education – Reverse Social Engineering – Locked accounts – Other authentication
  • 9. 95752:3-9 Grab Password (locally) • Physical proximity – Shoulder surfing – Countermeasures • Education • Exercises • One-time passwords • Program access – Trojan Horse – Perverted program – Countermeasures • Integrity checks • Other authentication
  • 10. 95752:3-10 Under normal conditions, the data in a packet transmitted over the network is read only by the destination system to which it is addressed. Router Local Network Operation
  • 11. 95752:3-11 When a packet sniffer is present, a copy of all packets that pass by it on the network are covertly captured. Packet Sniffer Executing Router Packet Sniffing
  • 12. 95752:3-12 Wide Area Network Operation • Always Switched – Circuit-Switched – Packet-Switched • Switch Settings determine route • Choice Points: Routers – Connect two or more networks – Maintain information on best routes – Exchange information with other routers
  • 13. 95752:3-13 Network Redirection Intruders can fool routers into sending traffic to unauthorized locations
  • 14. 95752:3-14 Other Network Attacks • Tapping – Method depends on network medium – Countermeasures: • Encryption • Physical protection & inspection • Van Eck Radiation – Current through wire: Radio waves – Receiver tunes in on hosts/network – Countermeasures: • Encryption • Distance • Emission Control
  • 15. 95752:3-15 Generate Password • Use a dictionary • Requires: Scrambled password, Encryption method & Large dictionary • Password Cracking – Natural language words and slang – Backwards / Forwards / Punctuation and Numbers inserted – Program: 27,000 passwords in approx 3 seconds (Pentium II/133) • Countermeasures – Preventive strike (BEWARE) – Password rules – Other authentication
  • 16. 95752:3-16 Guess Password • Use knowledge of user – System information – Personal information – Occupation information • Often combined with dictionary attack • Countermeasures – Password rules – Other authentication
  • 17. 95752:3-17 Passwords on Many Machines • One or Many? – Ease of memorization vs. likelihood of writing – Options: • Secure stored passwords • Network authentication method • Algorithm for varying passwords
  • 18. 95752:3-18 Something You Have • Convert logical security to physical security – One-time pad – Strip card / smart card – Dongle – Challenge-Response calculator • Problems: Cost & token issuing/handling • Advantages: Physical presence; hard to hack
  • 19. 95752:3-19 Something You Are • Biometrics: Measure physical characteristic – Face geometry – Hand geometry – Fingerprint – Voiceprint – Retinal Scan – Signature • Advantages: Physical presence, not easily lost • Disadvantages: Cost, Security, Variation, Handicaps
  • 20. 95752:3-20 Authentication Summary • Many different options available • None perfect • Combined solutions are possible • Risk: assumption that other method will protect weaknesses • Overlapping design needed
  • 21. 95752:3-21 Computer Files • File: almost every visible aspect of system • Human names vs. Computer reference • Information on files: – Location – Size – Type – Creation and access times – Owner – Protections
  • 22. 95752:3-22 File Protections • File Permissions: grouped usage – Owner, Collaborators and others – Read, Write, Execute, etc. allowed • Access Control Lists: who can do what – Account name and permissions • Syntax and Semantics depend on Operating System
  • 23. 95752:3-23 Using File Permissions • Be as restrictive as reasonable • Use minimal permissions as defaults • Enforce individual account usage • Use directory permissions “Something everyone owns, no one owns”
  • 24. 95752:3-24 Defeating File Permissions • Physical access: – Reboot under different Operating System – Raw access • Subvert applications – Trojan Horses – Direct corruption – Virus • Countermeasures: – Physical protection – Disk encryption – Configuration Control – Integrity checking

Editor's Notes

  • #10: Quickly define packet in course of discussion. DON’T PATRONIZE! Also briefly walk through base diagram, as it is used over the next few slides. Just walk through explanations of what is happening on the following slides.
  • #11: There are technical fixes to this -- including good choice of network cards so that most hosts on your net cannot support sniffers (but this needs to be specified in policy). Can also monitor your network to spot sniffers executing, but this needs staffing and authorization.
  • #13: Fix is to have routers listen only to approved information sources, but this may involve pressure on vendors to fix current problems, as well as defining what an “approved information source” is. Many sites cannot afford to sacrifice flexibility in connectivity, so may have some tradeoffs here.