Copyright
Acquiring Editor:Chris Katsaropoulos
Editorial Project Manager:Benjamin Rearick
Project Manager:Mohana Natarajan
Designer:Alan Studholme
Syngress is an imprint of Elsevier
225 Wyman Street, Waltham, MA 02451, USA
Second edition 2014
Copyright 2014, 2011 Elsevier Inc. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means electronic, mechanical, photocopying, recording or otherwise without the prior written permission of the publisher.
Permissions may be sought directly from Elsevier's Science & Technology Rights Department in Oxford, UK: phone (+ 44) (0) 1865 843830; fax (+ 44) (0) 1865 853333; email: , and selecting Obtaining permission to use Elsevier material.
Notice
No responsibility is assumed by the publisher for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions or ideas contained in the material herein. Because of rapid advances in the medical sciences, in particular, independent verification of diagnoses and drug dosages should be made.
Library of Congress Cataloging-in-Publication Data
Application Submitted
British Library Cataloguing in Publication Data
A catalogue record for this book is available from the British Library
For information on all Syngress publications, visit our web site at store.elsevier.com/syngress
ISBN: 978-0-12-417142-8
Printed and bound in USA
14 15 16 17 18 10 9 8 7 6 5 4 3 2 1
Author biography
Seth Misenar (CISSP, GIAC GSE, CompTIA CASP, GPEN, GCIH, GCIA, GCFA, GWAPT, GCWN, GSEC, MCSE, and MCDBA) is a Certified Instructor with the SANS Institute and coauthor of the SANS SEC528: SANS Training Program for the CompTIA Advanced Security Practitioner (CASP) Certification. Seth also serves as lead consultant for Jackson, Mississippi-based Context Security. Seth's background includes security research, network and Web application penetration testing, vulnerability assessment, regulatory compliance efforts, security architecture design, and general security consulting. He has previously served as a physical and network security consultant for Fortune 100 companies as well as the HIPAA and information security officer for a state government agency. Seth teaches a variety of courses for the SANS Institute, including Security Essentials, Advanced Web Application Penetration Testing, Hacker Techniques, and the CISSP and CASP courses.
Seth is pursuing a Master of Science degree in information security engineering from the SANS Technology Institute and holds a Bachelor of Science degree from Millsaps College. Seth resides in Jackson, Mississippi, with his family, Rachel, Jude, and Hazel.
Eric Conrad (CISSP, GIAC GSE, GPEN, GCIH, GCIA, GCFA, GAWN, GSEC, GISP, CompTIA CASP, and Security +) is a partner with Backshore Communications, which provides information warfare, penetration testing, incident handling, and intrusion detection consulting services. He is also a Certified Instructor with the SANS Institute and coauthor of SANS Security 528: SANS Training Program for the CompTIA Advanced Security Practitioner (CASP) Certification.
Eric's professional career began in 1991 as a UNIX systems administrator for a small oceanographic communications company. He gained information security experience in a variety of industries, including research, education, power, Internet, and healthcare, in roles ranging from systems programmer to security engineer to HIPAA security officer and ISSO. He has taught thousands of students in courses including SANS Management 414: CISSP, Security 560: Network Penetration Testing and Ethical Hacking, Security 504 Hacker Techniques, Exploits and Incident Handling, and others.
Eric is a graduate of the SANS Technology Institute with a Master of Science degree in information security engineering. Eric currently lives in Peaks Island, Maine, with his family, Melissa, Eric, and Emma.
Joshua Feldman (CISSP, NSA IAM) has supported the Department of Defense Information Systems Agency (DISA), as a contractor working for SAIC, Inc., since 2002. He is a subject matter expert and training developer for DISAs cyber security mission. During his tenure, he has contributed to the DoD 8500 series, specifically conducting research and authoring sections of the DoD 8570.01-M, also known as the DoD IA Workforce Improvement Program. He is the program manager for DISAs Computer Network Defense training initiative (entitled, RaD-X) and has instructed well over 1000 students. He also is a subject matter expert for the Web-based Information Assurance awareness training every DoD user is required to take each year as part of their security awareness curriculum. He is a regular presenter and panel member at the Information Assurance Symposium, hosted by both DISA and NSA.
Before joining the support team at DoD/DISA, Joshua spent time as an IT Sec engineer working for the Department of State, Diplomatic Security. There, he traveled to embassies worldwide to conduct Tiger Team assessments of the security of each embassy. Joshua got his start in the IT Security field when he left his position teaching science for Montgomery County Public Schools, Maryland, and went to work for NFR Security Software. At the time, NFR was one of the leading companies producing Network Intrusion Detection systems.
Chapter 1
Domain 1: Access Control
Abstract
Access Control, the topic of this chapter and Domain 1 of the CISSP, presents numerous critically important terms and concepts that permeate several domains. This chapter introduces the CIA triad of confidentiality, integrity, and availability, which are touched upon in virtually every domain and chapter. In addition to CIA, concepts such as the principle of least privilege and need to know are presented. The application of these principles in the form of access control models such as Mandatory Access Control (MAC), Discretionary Access Control (DAC), and Role-Based Access Control (RBAC) represents a significant amount of this domains material. Understanding the key categories of access control defenses, preventive, detective, corrective, recovery, deterrent, and compensating controls, is necessary for this and numerous other domains. The final major content area in this chapter is dealing with authentication by introducing methods, protocols, and concepts related to ensuring and identity claim can be validated appropriately.
Keywords
Confidentiality; Integrity; Availability; Identification; Authentication; Authorization; Accountability; Subject; Object; Discretionary Access Control (DAC); Mandatory Access Control (MAC); Role-Based Access Control (RBAC); False Reject Rate (FRR); False Accept Rate (FAR); Crossover Error Rate (CER)