2. AUTHORIZATION AND ACCESS CONTROL

3. DATA SECURITY identification Authentication Authorization

4. AUTHORIZATION Allows to specify where the party should be allowed or denied access Implemented through the use of access controls Allowing access means keeping in mind the PRINCIPLE OF LEAST PRIVELEGE

5. PRINCIPLE OF LEAST PRIVILEGE Dictates that we should only allow the bare minimum of access to a party – this might be a person, user account, or process – to allow it to perform the functionality needed of it. Example : Employee in Sales Dept. should not need access to data internal to a human resource system in order to do their job

6. ACCESS CONTROL the selective restriction of access to a place or other resource BASIC TASKS Allow access Deny access Limit access Revoke access

7. ACCESS CONTROL ALLOW ACCESS Giving a particular party, or parties, access to a given resource DENY ACCESS Preventing access by a given party to the resource in question

8. ACCESS CONTROL LIMIT ACCESS Allowing some access to a resource but only up to a certain point REVOKE ACCESS Taking away access to a resource

9. ACCESS CONTROL MODELS Discretionary Access Control Mandatory Access Control Role-Based Access Control Attribute-Based Access Control Multi-level Access Control

10. DISCRETIONARY ACCESS CONTROL Model of access control based on access determined by the owner of the resource. The owner can decide who does and does not have access and what access they are allowed to have

11. MANDATORY ACCESS CONTROL Model of access control which the owner of the resource does not get to decide who gets to access it but instead access is decided by a group or individual who has the authority to set access on resources. Example : Government organizations where access to a resource is dictated by the sensitivity label applied to it (secret, top secret etc)

12. ROLE-BASED ACCESS CONTROL Model of access control where functions of access control is set by an authority responsible for doing so and the basis for providing access is based on the role the individual has to be granted access.

13. ATTRIBUTE-BASED ACCESS CONTROL Model of access control based on attributes of a person, a resource or the environment SUBJECT ATTRIBUTE Attributes that a person possess Example : “You must be this tall to ride” Captcha – Completely Automated Public Turing Test to Tell Humans and Computers Apart

14. ATTRIBUTE-BASED ACCESS CONTROL Model of access control based on attributes of a person, a resource or the environment RESOURCE ATTRIBUTE Attributes that is related to a particular resource like OS or application Example Software running on a particular OS Web site that works on a certain browser

15. ATTRIBUTE-BASED ACCESS CONTROL Model of access control based on attributes of a person, a resource or the environment ENVIRONMENT ATTRIBUTE Attributes used to enable access controls that operate based on environmental conditions Example Time attribute

16. MULTI-LEVEL ACCESS CONTROL Model of access control that uses two or more methods to improve security of a resource Bell-LaPadula Model Biba Model Brewer and Nash

17. PHYSICAL ACCESS CONTROL Concerned with controlling the access of individuals and vehicles Access of individuals such as in and out of a building or facility. TAILGATING occurs when we authenticate to the physical control measure such as a badge and then another person follows directly behind us without authenticating themselves.

18. PHYSICAL ACCESS CONTROL For vehicles, simple barriers, one-way spike strips, fences, rising barriers, automated gates or doors

19. THANK YOU