Network Defence – Access Control Concepts

Zero Trust Security

Zero trust represents a comprehensive strategy for securing access across various domains such as networks, applications, and environments. This method ensures the protection of access rights for users, end-user devices, APIs, IoT devices, microservices, containers, and more. It safeguards an organization’s workforce, workloads, and workplace.

The fundamental principle underlying the zero-trust approach is “never trust, always verify.” It implies that every time someone or something requests access to assets, they should be treated as untrusted until their identity is verified. The zero-trust security framework is designed to prevent unauthorized access, contain breaches, and minimize the potential for attackers to move laterally within a network.

Traditionally, the network perimeter, also known as the edge, served as the dividing line between trusted and untrusted areas. However, in the context of the zero-trust approach, any point where access control decisions are made should be regarded as a potential perimeter.

This means that even if a user or entity has previously gained access through one access control point, they are not automatically trusted to access other areas or resources unless they authenticate themselves. In certain situations, users may need to authenticate multiple times and use different methods to access different layers of the network. There are three pillars of zero trust security which are workforce, workloads, and workplace.

Zero Trust for the workforce

This aspect involves individuals, including employees, contractors, partners, and vendors, who utilize their personal or company-managed devices to access work-related applications. This facet of security guarantees that only authorized users and trusted devices can access applications, irrespective of their location

Zero Trust for the workload

This component addresses applications operating in cloud environments, data centers, and various virtualized settings, all of which communicate with each other. Its primary emphasis is on ensuring secure access when an API, microservice, or container needs to interact with a database within an application.

Zero Trust for the Workplace

This aspect prioritizes ensuring secure access for all types of devices, including those within the Internet of Things (IoT), that establish connections with enterprise networks. These devices encompass user endpoints, physical and virtual servers, printers, cameras, HVAC systems, kiosks, infusion pumps, industrial control systems, and various others.

Access Control Models

To safeguard its network resources, information systems, and information, an organization needs to establish effective access controls. To gain insight into potential vulnerabilities and threats, a security analyst should grasp the fundamentals of various access control models, enabling them to comprehend how attackers may attempt to circumvent these security measures.

Discretionary Access Control (DAC)

This model, known as the least restrictive, empowers data owners to manage access to their data. In the context of DAC (Discretionary Access Control), access permissions can be defined using ACLs (Access Control Lists) or alternative approaches to indicate which users or user groups are granted access to the information.

Mandatory Access Control(MAC)

This approach enforces the most stringent access control measures and is commonly employed in military or highly critical applications. It involves assigning security-level labels to information and granting access to users based on their security clearance level.

Role-Based Access Control(RBAC)

Access determinations are rooted in an individual’s functions and duties within the organization. Various roles are granted specific security privileges, and individuals are linked to the Role-Based Access Control (RBAC) profile corresponding to their role. These roles can encompass diverse positions, job categories, or groups of job categories. This system is also referred to as a form of non-discretionary access control.

Attribute-based access control(ABAC)

ABAC permits access based on attributes related to the object (the resource being accessed), the subject (the user seeking access), and environmental factors pertaining to how the object should be accessed, such as the specific time of day.

Rule-Base Access Control(RBAC)

The network security team establishes sets of regulations or criteria linked to data or system access. These regulations can define allowed or prohibited IP addresses, particular protocols, and other related conditions. This approach is also recognized as Rule-Based Role-Based Access Control (RBAC).

Time-based Access Control (TAC)

Another access control model is the “principle of least privilege,” which advocates a restricted, necessity-based approach to bestowing user and process access privileges for particular information and tools. This principle asserts that users should only be provided with the minimal level of access essential for carrying out their job responsibilities.

A prevalent form of exploitation is known as “privilege escalation.” In this type of attack, vulnerabilities within servers or access control systems are manipulated to confer an unauthorized user or software process with higher privileges than they should rightfully possess. Once these elevated privileges are obtained, malicious actors can access sensitive data or gain control over a system.

Network Access Control (NAC) Systems

Network Access Control (NAC) systems play a crucial role in managing access to a network by enforcing an organization’s policies regarding individuals and devices seeking network access. These systems enable cybersecurity experts to oversee the users and devices connected to the network and exercise manual control over access when necessary.

NAC systems offer the following capabilities:

1. Swiftly implementing access policies tailored to various operational scenarios.
2. Identifying and profiling users and devices connected to the network to prevent potential harm from non-compliant systems infected with malicious software.
3. Facilitating secure access for network guests, often through registration portals.
4. Assessing device compliance with security policies based on user type, device type, and operating system before granting network access.
5. Addressing security incidents by either blocking, isolating, or rectifying non-compliant devices.

Given the expanded attack surface brought about by Bring Your Own Device (BYOD) and Internet of Things (IoT) networking, NAC system automation features become indispensable for maintaining precise control over network access by such devices. These NAC systems are configured to uphold organizational policies, with these policies determining whether network access is granted or denied based on various factors detected by the NAC system on devices seeking access. Without NAC systems, it would be unmanageable for cybersecurity personnel to evaluate the multitude of devices attempting to access the network.

NAC serves as a pivotal component within a zero-trust security framework, ensuring compliance with security policies for all devices and users endeavoring to access the network.

FAQs

1. What is Zero Trust Security, and what does it aim to protect? Zero Trust Security is a comprehensive strategy that aims to secure access across networks, applications, and environments. It protects access rights for various entities, including users, devices, APIs, and more. Its goal is to safeguard an organization’s workforce, workloads, and workplace.
2. What is the fundamental principle of Zero Trust Security? The fundamental principle is “never trust, always verify.” This means that every request for access, whether by a user or device, is treated as untrusted until their identity is verified.
3. How does Zero Trust Security help prevent unauthorized access and contain breaches? Zero Trust Security prevents unauthorized access by requiring verification for every access request. It also minimizes lateral movement within a network, making it harder for attackers to spread once inside.
4. In Zero Trust Security, what is the new perspective on the network perimeter? In the Zero Trust approach, any point where access control decisions are made is considered a potential perimeter. This means that even if access has been granted at one point, it’s not automatically trusted for other areas or resources.
5. What are the three pillars of Zero Trust Security, and what do they encompass? The three pillars are:
   • Zero Trust for the Workforce: Ensures authorized users and trusted devices can access applications, regardless of their location.
   • Zero Trust for the workload: Focuses on securing access for applications in various environments.
   • Zero Trust for the workplace: Prioritizes secure access for all types of devices, including IoT devices, connecting to enterprise networks.

6. What is Discretionary Access Control (DAC), and how does it work?DAC empowers data owners to control access to their data, often using Access Control Lists (ACLs) or alternative methods to specify which users or user groups have access.
7. What is Mandatory Access Control (MAC), and where is it commonly used?MAC enforces strict access control based on security labels assigned to information. It’s commonly used in military or highly critical applications.
8. Explain Role-Based Access Control (RBAC) and how it operates.RBAC grants access based on individuals’ roles within an organization. Users are associated with specific roles, each with its own set of security privileges.
9. What is Attribute-based Access Control (ABAC), and what factors does it consider for access decisions?ABAC permits access based on attributes related to the object, subject, and environmental factors. It considers information about the resource, user, and access context.
10. What is Time-based Access Control (TAC), and why is the “principle of least privilege” important in access control?TAC restricts access based on time, and the “principle of least privilege” advocates granting users only the minimal access needed for their job responsibilities. This minimizes the risk of privilege escalation.

11. What is the role of Network Access Control (NAC) systems in network security?NAC systems manage access to a network by enforcing an organization’s access policies for individuals and devices seeking network access.
12. What capabilities do NAC systems offer?NAC systems can swiftly implement access policies, identify and profile users and devices, facilitate secure access for guests, assess device compliance, and address security incidents.
13. Why are NAC systems important in the context of Bring Your Own Device (BYOD) and Internet of Things (IoT) networking?NAC systems are crucial for maintaining control over network access by devices in BYOD and IoT scenarios, as they help ensure compliance with security policies.
14. How do NAC systems integrate with a Zero Trust Security framework?NAC serves as a pivotal component in a Zero Trust Security framework by ensuring compliance with security policies for all devices and users attempting to access the network, aligning with the “never trust, always verify” principle.