Welcome back.
So in the last section we introduced
ourselves with security plus exam information, topics that it covers, and
we also touched on some basic terms and concepts in security where we explained
the CIA triangle and we gave an example of how a layered concept of defense could
look like.
But now let's dive into our first topic
which is authentication and access control.
Once again, feel free to organize the way
that you follow each topic based on how you prefer.
If you don't have any special preference which topic you want to learn first, then
you can simply follow along the course as we go.
Okay, back to the authentication and access control.
We will start with the concept of control first.
So before we get to access control and
account or file access controls and permissions which are most common to hear
about, let's first talk about what different types of control even are there.
So we have several.
These would be some of the main controls
which are technical control, administrative control, as well as
operational control and physical control.
Now sometimes you might hear about only
three of these being the main ones without physical control or without
operational control, but in general all four are equally important and they play
a big part in security itself .
Now let's explain all of them one by one.
So technical control is control
implemented by the IT team in order to lower the risk of being compromised or exploited.
These would include things like having IPS or IDS, where IDS or intrusion
detection system would look at the network and try to discover or identify
any changes or threats, while IPS or intrusion prevention system would be
there to stop attacks taking place.
And we would also have things such as
firewall and firewall rules which could block unwanted traffic both coming to the
network and going out of the network.
We would also have antivirus programs
which are security measures used to protect our endpoint devices and desktops.
Next up we have administrative control which is done by the management team or
the administrators and its goal is to write the policies which will lower risk
of compromise or pretty much lower any unwanted risk inside the company.
There are many of these procedures that can lower the risk inside the company and
one of them is doing penetration tests regularly which we will talk about later
in the course.
Next one we have operational controls
which is done by company employees on daily basis.
These include things like employee training or education every year
regarding security.
These trainings help employees know
exactly what they should and shouldn't do.
For example inside the training you might
tell an employee that they should wear their ID cards with them and that rule
should be respected every single day so all the employees should wear their ID
badges or ID cards every time they come to work.
It could also be some type of a cyber security training where employees are
educated not to open spam emails and they're educated to recognize phishing
links and attacks.
Employees are also taught about business
plan of continuity or also known as BCP which is a policy on how each employee
will act in case of incident or if some type of unwanted situation occurs.
This would help company's business continue even in a case of catastrophe.
Next up we have physical control which is self -explanatory.
Now physical security control is there to prevent unauthorized access to the
company facility and its data.
These types of controls could include
things like wearing security badges, having gates and fences around the
company building, having a visitors list so for example if there is a certain
group of visitors coming inside your company building you want to have someone
identify them and write their names down in case anything happens so we have a
list of who entered and left the building.
You want to have CCTV cameras, you want
to have good lighting around the building so everything can be seen well and for
both outside and inside buildings you want to have guards that are there to protect.
Now ideally you want to have multiple guards in case one of them gets distracted.
You also want to have alarms inside the building, electronic locks, biometric
locks, tokens, contactless cards and you want to have things such as fire
extinguishers in case fire breaks out.
Now these would be some of the most
important things when it comes to physical control.
And also in case your company has big server rooms for example you want to make
sure that the temperature of the room is good.
So for example we could think about
implementing heating, ventilation and air conditioning and we also want to have
fire protection implemented close to the important server rooms so if there is
some type of fire outbreak we can put it out relatively quickly.
Now these are some of the physical security controls that are the most
important but of course there are other ones that you can include such as for
example having cable locks on your devices so that they can't get stolen.
You could have safe or a security room where all the laptops and other devices
are stored when they are not used.
Now this is not primarily to prevent the
theft of the laptops themselves but rather the data on those laptops which
could be far more important and valuable.
Now of course besides all of this there
are some other advanced methods such as for example implementing Faraday cage
which is a metal construction which can prevent wireless devices to work inside
the company.
Okay so that would be physical control or
physical security control.
And besides these four types of control
it is also important that we know the term of access control.
Now concept of access control and the term itself is important for us.
Its name is self -explanatory.
We know what access control means.
It is either preventing or granting access to someone based on certain types
of rules or certain policy.
Now there are three main components of
access control that we should be familiar with.
And those are identification,
authentication and authorization.
Now identification can be considered as
an individual having a smart card or having their own account for example.
Authentication is an individual authenticating their identity.
This can be done by entering a password for an account or entering pin code.
And authorization is last part which is level of access which will be granted to
an individual once he gets authenticated.
This can differ from person to person
depending on their position in company and their spec of work.
For example someone working in sales department will only be authorized to
have access to sales group and its data.
Now here comes the term that we already
covered which is least privilege.
Where an individual should only have
minimal access but enough to be able to do their work.
Ok so these three are important.
Make sure to remember what identification
is, what authentication is and what authorization is and what they are used for.
Now besides this we also have different types of access control.
And these would include MAC or mandatory access control which is based on
classification of data and can be divided into top secret, secret, confidential and restricted.
The next one that we have is discretionary access control or DAC which
is similar to least privilege concept.
But in this case it refers to one user
where user is given enough access to finish or do their work.
Now to fully understand this we will take a look at an example in one of the next
lectures where we cover file permissions which is a part of DAC.
So we will look at both Windows and Linux file access control or file permissions
and we will explain them in detail.
Ok besides this we also have rule based
access control which are different set of rules aimed towards employees.
This can be different for individuals working in separate departments.
For example the sales team will have access in the morning hours while
financial team will have access in the afternoon.
These rules can be based on other things
as well and don't have to just be based on time.
Now another type of access control that I just want to mention is role based access control.
Which are set of rules that are based for an individual role and sometimes you can
find it confusing since both rule based access control and role based access
control have same short identification of RBAC.
Just make sure that you remember both of
them so there is rule based and role based access control.
Now besides these two we also have attribute based access control and
attribute based access control is an authorization model that evaluates
attributes or characteristics rather than roles which are then used to determine
the access of an individual.
And last but not least we have group
based access control where you group individuals from let's say IT department
and give them access to the IT data that they need.
You would first make a list of all the people from IT department, form a group
with all of them and then grant access to that group to certain data that the group
works with.
Here is an example of how a group based
access control would look like.
So we have two different people that both
need access to same type of data.
We can create group, we can add everyone
that needs access to this type of data to that group and then grant that data to
the group itself rather to each person or each employee individually.
Now besides the current controls that we already mentioned let's also mention few
more which you should be familiar with and those are preventive controls,
corrective controls and compensating controls.
One thing to note is that these are all
types of controls and if certain rule applies to one type of control it doesn't
mean it can't be a part of a different type of control as well.
A certain policy, rule or control can be a part of many of the current types of
control that we discussed in this lecture.
So let's define each of these one by one.
Preventive controls attempt to prevent security incidents.
Now for example system hardening or user training can be example of this.
On the other hand corrective controls attempt to reverse the impact of an
incident or a problem after it has occurred.
And compensating controls are controls
which are alternative and they are used when it is not possible to use the
primary controls.
For example let's say an employee should
authenticate via smart card as a primary method or primary control but he hasn't
received his smart card yet since he is a new employee and he got hired yesterday.
We could use compensating controls such as perhaps authenticating via password
instead until they get their new ID card or smart card.
Ok so that would be about it when it comes to different groups or different
types of control.
Quite a long video right?
Well no worries by going over these different types of control and different
types of access control two or three times you should remember the most
important thing and that is what they are mostly focused on.
You should remember each of them and their basic definitions.
The good thing is that for many of them their name is self -explanatory such as
for example mentioning let's say physical security control.
Even without going over the video again you can think of what exactly that would
be right?
Well nonetheless let's not make the video
any longer and let's get straight into the next lecture where we will talk about
identity and different types of identity.
See you in the next lecture.