CYS406 · Chapter 2 · Annotated SlidesIdentification, Authentication and Authorization
Original
Overview

Identification, Authentication and Authorization

Access-control terminology and principles, the DAC, MAC, RBAC and rule-based models, identity and access management, the types of authentication (password, two-factor, biometrics, smart cards, SSO), authorization and accounting.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 30 slides
  1. 1 Slide 1
  2. 2 Module Objectives
  3. 3 Module Flow
  4. 4 Access Control
  5. 5 Access Control Terminologies
  6. 6 Access Control Principles
  7. 7 ❑ Access control models are the standards which provide a predefined framework for implementing the necessary level of access control
  8. 8 Slide 8
  9. 9 Slide 9
  10. 10 Slide 10
  11. 11 Slide 11
  12. 12 Slide 12
  13. 13 Slide 13
  14. 14 Slide 14
  15. 15 Slide 15
  16. 16 Logical Implementation of DAC, MAC, and RBAC
  17. 17 Logical Implementation of DAC, MAC, and RBAC (Cont’d)
  18. 18 Module Flow
  19. 19 Identity and Access Management (IAM)
  20. 20 Identity and Access Management (IAM) (Cont’d)
  21. 21 User Identity Management (IDM)
  22. 22 User Access Management (AM): Authentication
  23. 23 Types of Authentication
  24. 24 Types of Authentication (Cont’d)
  25. 25 Types of Authentication
  26. 26 Types of Authentication (Cont’d)
  27. 27 Types of Authentication (Cont’d)
  28. 28 User Access Management (AM): Authorization
  29. 29 User Access Management (AM): Accounting
  30. 30 Module Summary
Slide 1 / 30

Slide 1

Slide 1: Slide 1
Slide 2 / 30

Module Objectives

Slide 2: Module Objectives
Slide 3 / 30

Module Flow

Slide 3: Module Flow
Slide 4 / 30

Access Control

Slide 4: Access Control

Notes

  1. Access control: who (subject) can do what (operation) to which resource (object).

Slide 5 / 30

Access Control Terminologies

Slide 5: Access Control Terminologies

Notes

  1. Identification (claim who you are) → Authentication (prove it) → Authorization (what you may do) → Accounting (log what you did).

  2. Memory trick I-A-A-A: Identify, Authenticate, Authorize, Account.

Exam angle

PredictionQ1

Entering a username is:

PredictionQ2

Deciding which files a logged-in user may open is:

Slide 6 / 30

Access Control Principles

Slide 6: Access Control Principles

Exam angle

PredictionQ1

Giving users only the access they need for their job is:

Slide 7 / 30

❑ Access control models are the standards which provide a predefined framework for implementing the necessary level of access control

Slide 7: ❑ Access control models are the standards which provide a predefined framework for implementing the necessary level of access control

Notes

  1. DAC: the owner decides access. MAC: the system decides by labels/clearances (military). RBAC: by job role. Rule-based: by rules (e.g. time of day).

Exam angle

PredictionQ1

Access decided by security labels and clearance levels is:

PredictionQ2

A file owner granting a colleague read access is:

Slide 8 / 30

Slide 8

Slide 8: Slide 8
Slide 9 / 30

Slide 9

Slide 9: Slide 9
Slide 10 / 30

Slide 10

Slide 10: Slide 10
Slide 11 / 30

Slide 11

Slide 11: Slide 11
Slide 12 / 30

Slide 12

Slide 12: Slide 12
Slide 13 / 30

Slide 13

Slide 13: Slide 13
Slide 14 / 30

Slide 14

Slide 14: Slide 14
Slide 15 / 30

Slide 15

Slide 15: Slide 15
Slide 16 / 30

Logical Implementation of DAC, MAC, and RBAC

Slide 16: Logical Implementation of DAC, MAC, and RBAC
Slide 17 / 30

Logical Implementation of DAC, MAC, and RBAC (Cont’d)

Slide 17: Logical Implementation of DAC, MAC, and RBAC (Cont’d)
Slide 18 / 30

Module Flow

Slide 18: Module Flow
Slide 19 / 30

Identity and Access Management (IAM)

Slide 19: Identity and Access Management (IAM)
Slide 20 / 30

Identity and Access Management (IAM) (Cont’d)

Slide 20: Identity and Access Management (IAM) (Cont’d)
Slide 21 / 30

User Identity Management (IDM)

Slide 21: User Identity Management (IDM)
Slide 22 / 30

User Access Management (AM): Authentication

Slide 22: User Access Management (AM): Authentication
Slide 23 / 30

Types of Authentication

Slide 23: Types of Authentication

Notes

  1. Factors: something you KNOW (password), HAVE (token, smart card), ARE (biometric). Two-factor = two DIFFERENT categories.

  2. Trap A password + a PIN is still ONE factor (both are something you know).

Exam angle

PredictionQ1

Which is two-factor authentication?

Slide 24 / 30

Types of Authentication (Cont’d)

Slide 24: Types of Authentication (Cont’d)
Slide 25 / 30

Types of Authentication

Slide 25: Types of Authentication

Notes

  1. Biometrics: fingerprint, face, iris, retina, voice, vein. Errors: false acceptance (FAR) and false rejection (FRR); CER is where they are equal.

Exam angle

PredictionQ1

A biometric system letting in an unauthorized person is a:

Slide 26 / 30

Types of Authentication (Cont’d)

Slide 26: Types of Authentication (Cont’d)
Slide 27 / 30

Types of Authentication (Cont’d)

Slide 27: Types of Authentication (Cont’d)
Slide 28 / 30

User Access Management (AM): Authorization

Slide 28: User Access Management (AM): Authorization
Slide 29 / 30

User Access Management (AM): Accounting

Slide 29: User Access Management (AM): Accounting
Slide 30 / 30

Module Summary

Slide 30: Module Summary