Slides da aula de Segurança Computacional

1. © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Fundamentals of Information
Systems Security
Unit 3
Controles de acesso apropriados para
sistemas, aplicativos e acesso a dados

2. Page 2Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Learning Objective
Explain the role of access controls in
implementing security policy.

3. Page 3Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Key Concepts
§ Authorization policies enforcing access control to
systems, application, and data
§ Role of identification in granting access to
information systems
§ Role of authentication in granting access to
information systems
§ Authentication factor types and need for two- or
three-factor authentication
§ Pros and cons of formal models used for access
controls

4. Page 4Introduction to Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
DISCOVER: CONCEPTS

5. Page 5Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Defining Access Control
§The process of protecting a resource so
that it is used only by those allowed to do
so
§Prevents unauthorized use

6. Page 6Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Four Parts of Access Control
Access Control
Component
Description
Authorization Who is approved for access and
what can they use?
Identification How are they identified?
Authentication Can their identities be verified?
Accountability How are actions traced to an
individual to ensure that the person
who makes data or system
changes can be identified?

7. Page 7Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Access Control Basics
§Access control provides a set of resources
available to the authenticated identity.
§Access controls can be logical or physical.
§Before authorization can occur, the identity
of the account attempting to access a
resource must be determined.

8. Page 8Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Access Control Basics
(Continued)
§Identification presents credentials.
§Authentication associates those credentials
with a security principal.
§Accountability traces an action to a person
or process to know who made the changes
to the system or data.

9. Page 9Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Policy Definition and Policy
Enforcement Phases
§ Policy definition phase decides who has
access and what systems or resources they
can use.
• It is tied to the authorization phase.
§ Policy enforcement phase grants or rejects
requests for access based on the
authorizations defined in the first phase.
• It is tied to identification, authentication,
and accountability phases.

10. Page 10Introduction to Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
DISCOVER: PROCESSES

11. Page 11Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Scenario 1
§Select access control methods for the
Department of Defense (DoD) network.

12. Page 12Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Solution
§Use a combination of biometric,
token-based, and password-form access
methods.
§Use more complex forms of authentication,
such as time-of-day restrictions and
hardware encryption devices.
§Each account attempting to make a
transaction must be properly identified.

13. Page 13Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Scenario 2
§Select access control methods for an
organization that does the majority of its
business through public kiosks.

14. Page 14Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Solution
§Authentication can be as simple as an
automatic anonymous guest logon shared
by all visitors.

15. Page 15Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Scenario 3
§Select access control methods for an
organization that does the majority of its
business through Web-based servers.

16. Page 16Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Solution
§Role-based access
§Single sign-on
§Remote Authentication Dial In User Service
(RADIUS)
§Strong passwords

17. Page 17Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
RADIUS

18. Page 18Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com

19. Page 19Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Desafio-Resposta

20. Page 20Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Logical Access Control Features
Logical Controls Solution?
Biometrics
Tokens
Passwords
Single sign-on

21. Page 21Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Recursos de controle de acesso
lógicoLogical Controls Solutions
Biometrics • Estático: impressões digitais, granularidade da íris,
vasos sanguíneos da retina, características faciais
e geometria da mão
• Dinâmico: inflexões de voz, traços de teclado e
movimentos de assinatura
Tokens • Síncrono ou assíncrono
• Cartões inteligentes e cartões de memória
Passwords • Controles de senha rigorosos para usuários
• Políticas de bloqueio de conta
• Auditando eventos de logon
Single sign-on • Processo Kerberos
• Sistema europeu seguro para aplicativos em um
ambiente de vários fornecedores (SESAME)

22. Page 22Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Tipos de Controle de Segurança

23. Page 23Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Controle de acesso baseados em regras

24. Page 24Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Controle de acesso baseados em valores, dados

25. Page 25Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Lista de Controle de Acessos

26. Page 26Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Questionamento 1
§ Como se dá o controle de acesso nos cenários abaixo, isto é, quem define a
política de acesso e quem impõe?
Cliente/Servidor P2P

27. Page 27Fundamentals of Information Systems Security © 2012 Jones and Bartlett Learning, LLC www.jblearning.com
Summary
§ Access control is the process of protecting a
resource so that it is used only by those
allowed to do so.
§ Access controls can be logical or physical.
§ Access control includes identification,
authentication, authorization, and
accountability.
§ The four parts of access control can be
categorized into policy definition phase and
policy enforcement phase.