Limit Access with Minimum Permissions Security planners constantly worry about access to resources. People who get access to resources can do damage to those resources. Not surprisingly, companies work very hard to control access to their resources. Access control is limiting who may have access to each resource and limiting his or her permissions when using the resource. Access control is limiting who may have access to each resource and limiting his or her permissions when using the resource. Figure 4-20: Least Permissions in Access Control Access Control If attackers can’t get access to a resource, they cannot exploit it Access control is limiting who may have access to each resource And limiting his or her permissions when using the resource Authentication versus Authorizations (Permissions) Authentication: of identity Authorizations: Permissions a particular authorized user is with a resource Just because a user is authenticated does not mean that he or she will be permitted to do everything Principle of Least Permissions Give each authenticated user only the minimum permissions he or she needs to do his or her job Cannot compromise security by doing unauthorized things Examples of Limited Permissions Create files but not delete files Cannot access files above a specified level of sensitivity Read files but not edit them See files in own folder but not in other folders Connect to the person’s department server but not to the Finance server Do certain things but cannot give others permission to do them One aspect of access control that we saw in the previous chapter is authentication, is requiring users requesting access to prove their identities. However, just because you know who someone is does not mean that he or she should have unfettered access to your resources. (There undoubtedly are several people you know whom you would not let drive your car.) Authorizations or permissions are the actions that an authenticated user is allowed to take on the resource. For example, although everyone is permitted to view the U.S. Declaration of Independence, no one is allowed to add his or her own signature at the bottom. Authorizations or permissions are the actions that an authenticated user is allowed to take on the resource. An important principle in assigning permissions is to give each person least permissions—the minimum permissions that the user needs to accomplish his or her job. In the case of access to team documents, for example, most team members may be given
Limit Access with Minimum Permissions Security planners constantly worry about access to resources. People who get access to resources can do damage to those resources. Not surprisingly, companies work very hard to control access to their resources. Access control is limiting who may have access to each resource and limiting his or her permissions when using the resource. Access control is limiting who may have access to each resource and limiting his or her permissions when using the resource. Figure 4-20: Least Permissions in Access Control Access Control If attackers can’t get access to a resource, they cannot exploit it Access control is limiting who may have access to each resource And limiting his or her permissions when using the resource Authentication versus Authorizations (Permissions) Authentication: of identity Authorizations: Permissions a particular authorized user is with a resource Just because a user is authenticated does not mean that he or she will be permitted to do everything Principle of Least Permissions Give each authenticated user only the minimum permissions he or she needs to do his or her job Cannot compromise security by doing unauthorized things Examples of Limited Permissions Create files but not delete files Cannot access files above a specified level of sensitivity Read files but not edit them See files in own folder but not in other folders Connect to the person’s department server but not to the Finance server Do certain things but cannot give others permission to do them One aspect of access control that we saw in the previous chapter is authentication, is requiring users requesting access to prove their identities. However, just because you know who someone is does not mean that he or she should have unfettered access to your resources. (There undoubtedly are several people you know whom you would not let drive your car.) Authorizations or permissions are the actions that an authenticated user is allowed to take on the resource. For example, although everyone is permitted to view the U.S. Declaration of Independence, no one is allowed to add his or her own signature at the bottom. Authorizations or permissions are the actions that an authenticated user is allowed to take on the resource. An important principle in assigning permissions is to give each person least permissions—the minimum permissions that the user needs to accomplish his or her job. In the case of access to team documents, for example, most team members may be given
CH04_431_Spring%202016%20Sudents%20ALL.docx