1. Access Control Chapter 3 Part 4 Pages 227 to 241

2. Rule-Based Access Control See page 228 Traditionally, used with MAC See page 228 Many routers and firewall use rules to determine which packets are allowed in

3. Constrained User Interfaces Restricted menus Database views – Page 229 Figure 3-17 ATM machines

4. Access Control Matrix Figure 3-18 on page 230 Capability Tables – Table 3-1 on page 230 – Figure 3-18 on page 230 – Kerberos – user’s ticket is his capability table Access Control List (ACLs) – Table 3-2 on page 231 – Figure 3-18 on page 230

5. Content-Dependent Access Control Example e-mail filter – Specific string such as “social security number”, “top secret” Example web filter for employees – “gambling”, “pornography”

6. Context-Dependent Access Control Stateful Firewalls – Make sure there is a TCP connection Tracks user’s request in sequence looking for suspicious patterns

7. Access Control Techniques Page 233

8. Centralized Access Control Administration One entity oversees access to all corporate resources Consistent and uniform method of controlling user access AAA protocols – Authentication – Authorization – Auditing

9. RADIUS Network protocol that provides client/server authentication, authorization, and auditing of remote users. Most ISP use RADIUS – Customer provides username and password – Customer is given an IP address and Internet access Used for Road warriors and home workers.

10. TACACS+ Similar to RADIUS RADIUS uses UDP TACACS+ uses TCP – Detects packet corruption, dropped packets Encrypts all data If current environment authenticates users using Kerberos, TACACS+ can authenticate remote user’s in the same manner.

11. RADIUS vs TACACS+ RADIUS is the appropriate protocol when simplistic username/password authentication when need only Accept or Deny TACACS+ for more sophisticated authentication and complex authorization See Table 3-3 on page 238

12. Diameter Protocol built on functionality of RADIUS but for today’s diverse networks See Figure 3-21 on page 239

13. Decentralized Administration Give access control to those closer to the resources Manager for his employees Does not provide uniformity