Knowledge requirements

A candidate appearing for the CISSP exam should have knowledge in the following areas that relate to access control:

• Control access by applying concepts, methodologies, and techniques
• Identify, evaluate, and respond to access control attacks such as Brute force attack, dictionary, spoofing, denial of service, etc.
• Design, coordinate, and evaluate penetration test(s)
• Design, coordinate, and evaluate vulnerability test(s)

The approach

In accordance with the knowledge expected in the CISSP exam, this domain is broadly grouped under five sections as shown in the following diagram:

Section 1: The Access Control domain consists of many concepts, methodologies, and some specific techniques that are used as best practices. This section coverssome of the basic concepts, access control models, and a few examples of access control techniques.

Section 2: Authentication processes are critical for controlling access to facilities and systems. This section looks into important concepts that establish the relationship between access control mechanisms and authentication processes.

Section 3: A system or facility becomes compromised primarily through unauthorized access either through the front door or the back door. We’ll see some of the common and popular attacks on access control mechanisms, and also learn about the prevalent countermeasures to such attacks.

Section 4: An IT system consists of an operating system software, applications, and embedded software in the devices to name a few. Vulnerabilities in such software are nothing but holes or errors. In this section we see some of the common vulnerabilities in IT systems, vulnerability assessment techniques, and vulnerability management principles.

Section 5: Vulnerabilities are exploitable, in the sense that the IT systems can be compromised and unauthorized access can be gained by exploiting the vulnerabilities. Penetration testing or ethical hacking is an activity that tests the exploitability of vulnerabilities for gaining unauthorized access to an IT system.

Today, we’ll quickly review some of the important concepts in the Sections 1, 2,and 3.

Access control concepts, methodologies, and techniques

Controlling access to the information systems and the information processing facilities by means of administrative, physical, and technical safeguards is the primary goal of access control domain. Following topics provide insight into someof the important access control related concepts, methodologies, and techniques.

Basic concepts

One of the primary concepts in access control is to understand the subject and the object.

A subject may be a person, a process, or a technology component that either seeks access or controls the access. For example, an employee trying to access his business email account is a subject. Similarly, the system that verifies the credentials such as username and password is also termed as a subject.

An object can be a file, data, physical equipment, or premises which need controlled access. For example, the email stored in the mailbox is an object that a subject is trying to access.

Controlling access to an object by a subject is the core requirement of an access control process and its associated mechanisms. In a nutshell, a subject either seeks or controls access to an object.

An access control mechanism can be classified broadly into the following two types:

1. If access to an object is controlled based on certain contextual parameters, such as location, time, sequence of responses, access history, and so on, then it is known as a context-dependent access control. In this type of control, the value of the asset being accessed is not a primary consideration. Providing the username and password combination followed by a challenge and response mechanism such as CAPTCHA, filtering the access based on MAC adresses in wireless connections, or a firewall filtering the data based on packet analysis are all examples of context-dependent access control mechanisms.

   Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) is a challenge-response test to ensure that the input to an access control system is supplied by humans and not by machines. This mechanism is predominantly used by web sites to prevent Web Robots(WebBots) to access the controlled section of the web site by brute force methods

   The following is an example of CAPTCHA:

   

2. If the access is provided based on the attributes or content of an object,then it is known as a content-dependent access control. In this type of control, the value and attributes of the content that is being accessed determines the control requirements. For example, hiding or showing menus in an application, views in databases, and access to confidential information are all content-dependent.