On Authorization and Implementation of Access Control Models

guest · Feb 1, 2020

On Authorization and Implementation of Access Control Models
January 29, 2020
https://www.tripwire.com/state-of-s...ization-implementation-access-control-models/

There are dozens of implementations of authorization mechanisms. When there are complex requirements dictated by business processes, authorization mechanisms may often be implemented incorrectly or, at least, not optimally.
What is Authorization?
From the point of view of any information system, authorization is the decision-making process on providing access to resources to the subject based on specific knowledge about it. By this moment, the subject, as a rule, should already be identified (You need to know who he is.) and authenticated (His identity is confirmed.)
Problems
There are usually two sources of authorization requirements in a corporate information system. These are business requirements and security requirements.

A business owner wants to keep secrets and provide permissions to users in accordance with their function in the business process, and security wants to ensure the least privilege approach for each user and also to audit the access.
Click to expand...

Possible Solutions
The already created access control models may help in solving many problems:

MAC – mandatory access control. The subject’s access to the object is determined by its access level. The subject’s access level should not be lower than the level of secrecy of the object.
DAC – discretionary access control. The subject’s access to the object is determined by the presence of the subject in the object’s access-control list (ACL).
RBAC – role-based access control. The access of the subject to the object is determined by the presence of the role that contains permissions corresponding to the requested access.
ABAC – attribute-based access control. The subject’s access to the object is determined dynamically based on an analysis of policies that take into account the values of the attributes of the subject, object, and environment. This also includes PBAC, RAdAC, CBAC.
Click to expand...

Conclusion
Authorization is an undeservedly neglected topic, both in publications and directly during the development process. Two-factor authentication via SMS can be implemented even by a junior specialist; however, correctly implemented authorization in the corporate system is a nontrivial task even for seniors and architects.
Click to expand...

Log in or Sign up

On Authorization and Implementation of Access Control Models

guest Guest

Log in or Sign up

On Authorization and Implementation of Access Control Models

guest Guest

Useful Searches