Network Security and
Protection
Access Control & Identity Exploitation
Learning Outcome
5
Least Privilege, MFA, and regular access reviews.
4
Learn session security, monitoring, auditing, and access governance.
3
Identify risks such as IDOR, and privilege escalation.
2
Differentiate between DAC, MAC, RBAC
1
Explain Access Control, Authentication, and Authorization.
Introduction
to Access Control
Access Control regulates who can access resources and what actions they
can perform.
Objectives
Protect sensitive data
Prevent unauthorized access
Enforce security policies
Maintain confidentiality & integrity
Allows only authorized access
Reduces security risks
Prevents privilege
misuse
Supports compliance
Importance
Importance of Access Control in Security
Access control ensures only authorized users can access resources.
Access Control Principles
Need-to-Know:
Access only required information.
Least Privilege:
Grant only minimum required permissions.
Separation of Duties:
Split critical tasks among multiple users.
|
Verifies identity |
"Who are you?"
|
Occurs first |
|
Authentication |
|
Determines permissions |
|
"What can you do?" |
|
Occurs after authentication |
Authorization
1
2
3
4
User logs in
Identity verified
Permissions checked
Access granted
Example :-
Identity and Access Management (IAM)
Identity and Access Management (IAM) is a framework used to manage user identities and control access to resources.
Identity management
Authentication
Authorization
Access governance
Auditing
Understanding Digital Identities
A digital identity represents a user, device, or system within a digital environment.
Components
Username
User ID
Credentials
Attributes
Permissions
Identity Lifecycle Management
Identity lifecycle management involves managing identities throughout their existence.
User Accounts and Roles
Administrator
Manager
Employee
Guest
User Account :- Represents an individual or system.
Role :- Defines a set of permissions assigned to users.
Identity Verification Concepts
Passwords
Security Tokens
Biometrics
Multi-Factor Authentication
Identity verification confirms that a user is who they claim to be.
Common Methods
Privileged V/S
Non-Privileged Accounts
|
Feature |
|
Privileged Account |
Non-Privileged Account
|
Non-Privileged Use
|
|
Security Risk |
|
System Changes |
Access Level
|
Example |
| Administrative permissions |
Limited permissions
Reduces
unauthorized access
Can modify
system settings
Cannot modify system settings
Prevents
unwanted changes
Higher if compromised
Lower due to restricted access
Reduces attack impact
Administrator, Root
Standard User, Guest
Supports least privilege
Access Control Models
Role-Based Access Control (RBAC)
Access permissions are assigned to roles rather than individuals.
Benefits
Simplified administration
Scalable access management
Attribute-Based Access Control (ABAC)
Access decisions are based on attributes.
Examples of Attributes
User department , Time
Location , Device type
Comparison of Access Control Models
Authentication Fundamentals
Authentication is the process of verifying the identity of a user, device, or application before granting access to a system or resource.
Authentication Factors :-
Information known by the user.
Password
PIN
Security Token
Smart Card
Physical objects possessed by the user.
Fingerprint
Face Recognition
Iris Scan
Biometric characteristics.
Types of Authentication
What is Authorization?
Authorization is the process of determining what an
authenticated user is allowed to access or perform
within a system.
Access Permissions Common permissions include :-
Read , Write , Modify ,Delete , Execute
Types of Authorization
Role-Based Access Control (RBAC)
Attribute-Based Access Control (ABAC)
Access is based on the user's role.
Example:- HR staff can access employee records.
Access depends on attributes like user, location, or time.
Example:- Employees access files only during office hours.
Mandatory Access Control (MAC)
Discretionary Access Control (DAC)
The resource owner grants access.
Example:- A file owner shares a document
with specific users.
Access follows system-defined security policies.
Unclassified
Secret
Confidential
Top secret
Identity Management
Creates and manages user identities.
Example: Creating employee accounts.
Authentication
Verifies the identity of a user.
Example: Logging in with a password or fingerprint.
Authorization
Determines what resources a user can access.
Example: Allowing only managers to view payroll data.
Identity and Access Management (IAM)
is a security framework that manages user identities and controls access to system resources.
Access Control
Enforces permissions based on roles or policies.
Example: Restricting access to confidential files.
User Provisioning
Creates, updates, and removes user accounts automatically.
Example: Giving a new employee access to company systems.
Auditing and Monitoring
Tracks user activities and login events.
Example: Recording who accessed a database and when.
User Provisioning, Deprovisioning and Access Governance
Privileged Access Management (PAM)
Provisioning
Deprovisioning
Access Governance
Ensures access rights comply with policies.
Removing access when no longer required.
Creating and
assigning access.
Manages and monitors privileged accounts.
Limit privileged access
Monitor administrative actions
Reduce insider threats
Common Access Control Weaknesses
Broken Access Control
Access restrictions are
not properly enforced.
Impact: Unauthorized
resource access.
Missing Authorization Checks
Applications fail to verify user permissions before requests.
Excessive Permissions
Users receive more
permissions than required.
Privilege Mismanagement
Improper assignment or monitoring of privileged
accounts.
Insecure Direct Object References
Applications expose internal object IDs without authorization checks.
Impact: Unauthorized data access.
Credential Reuse
Using the same password across multiple accounts.
Identity Spoofing Concepts
Attackers impersonate legitimate users or systems.
Account Takeover Risks
Unauthorized control of user accounts.
Potential Impact :- Data exposure ,Financial loss, Service abuse
Identity-Related Security Risks
Weak Authentication Mechanisms
Weak authentication increases the likelihood of unauthorized access.
Credential Theft
Attackers obtain legitimate credentials through various means.
Authorization
Determines what actions an authenticated user can perform.
Core Cloud IAM Concepts
Users
Individual accounts that access cloud services.
Groups
A collection of users with similar access requirements.
Roles
A set of permissions assigned to users, groups, or services.
Identity
Authentication
Verifies the identity of a user before granting access.
A digital identity representing a user, application, or service in the cloud.
Policies
Permissions
Specific rights to perform actions on cloud resources.
Rules that specify which actions are allowed or denied.
Multi-Factor Authentication
Uses two or more verification methods to confirm identity.
Principle of
Least Privilege
Grants only the minimum permissions required to perform a task.
Monitoring and Auditing Access
Access Logging :-
Records authentication and authorization activities.
Audit Trails :-
Provide historical records of user actions.
Monitoring User Activity :-
Helps detect suspicious behavior.
Detecting Unauthorized Access :-
Monitoring tools identify abnormal access attempts.
Compliance and Audit Requirements :-
Support regulatory and security requirements.
Mitigation and Best Practices
1.Principle of Least Privilege
Grant only necessary permissions.
2. Strong Authentication Practices
MFA , Strong passwords , Passwordless solutions
3. Role-Based Access Management
Use roles instead of individual permissions.
5. Continuous Monitoring and Auditing
Continuously monitor access activities and security events.
Periodically review user permissions.
4. Regular Access Reviews
Emerging Trends in Identity Security
Zero Trust Architecture :-
Never trust, always verify.
Every access request must be authenticated and authorized.
Identity-Centric Security :- Identity becomes the primary security perimeter.
Adaptive Authentication :- Requirements change based on risk factors.
Behavioral Authentication :-
Uses user behavior to verify identity.
AI-Driven Identity Protection AI detects :- Suspicious logins , Account compromise
Summary
5
Zero Trust, Adaptive Authentication, and AI-driven Identity Protection.
4
Least Privilege, MFA, session management, and access reviews.
3
IAM manages identities and user access.
2
Access Control enforces permissions and security policies.
1
Authentication verifies identity; Authorization controls access.
Quiz
Which process determines what a user is
allowed to access?
A. Authentication
B. Authorization
C. Logging
D. Encryption
Quiz-Answer
Which process determines what a user is
allowed to access?
A. Authentication
B. Authorization
C. Logging
D. Encryption
