CMM7XX

Authentication & Access Control

Session 6: Identity Management

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Deconstruct modern Federated Identity protocols (SAML, OIDC, OAuth 2.0).
  • Understand the mathematics and application of Zero-Knowledge Proofs (ZKPs).
  • Evaluate Access Control Models (DAC, MAC, RBAC, ABAC).
  • Analyze mandatory security models (Biba vs Bell-LaPadula).
  • Design scalable Attribute-Based Access Control (ABAC) policies for cloud environments.

15 Minute Break

Please return promptly for Part 2.

Part 2: Access Control Models

Duration: 1.5 Hours

Practical Resource: NIST SP 800-162: Attribute-Based Access Control (ABAC)

Foundational Access Control Models

  • DAC (Discretionary Access Control): The data owner dictates who has access (e.g., standard Windows/Linux file permissions). Vulnerable to Trojan horses.
  • MAC (Mandatory Access Control): Central authority dictates access based on security labels (e.g., Top Secret, Secret) assigned to subjects and objects. Used in military/intelligence environments.
  • RBAC (Role-Based Access Control): Access is assigned to organizational roles (e.g., 'HR_Manager', 'Developer'), and users are assigned to roles. Solves the administrative nightmare of DAC at scale.
Practical Resource: RFC 2104: HMAC: Keyed-Hashing for Message Authentication

Mandatory Security Models

Theoretical frameworks governing MAC implementations.

Bell-LaPadula (Confidentiality)

  • No Read Up: Subject cannot read objects of higher classification.
  • No Write Down: Subject cannot write to objects of lower classification (prevents data leakage).

Biba (Integrity)

  • No Read Down: Subject cannot read lower integrity data (prevents contamination).
  • No Write Up: Subject cannot write to higher integrity objects.
Practical Resource: RFC 2104: HMAC: Keyed-Hashing for Message Authentication

Attribute-Based Access Control (ABAC)

The modern enterprise standard. Evaluates boolean logic against dynamic attributes of the User, Resource, Environment, and Action.

  • Unprecedented Granularity: "Allow 'HR_Rep' to 'Read' 'Employee_Record' ONLY IF 'Time' is between 9-5 AND 'User_IP' is within Corporate Subnet."
  • Dynamic: Can ingest threat intelligence feeds (e.g., block access if the user's location jumps continents impossibly fast).
  • Implementation: Heavily used in AWS IAM policies and XACML engines.
Practical Resource: MITRE ATT&CK Framework

Introduction to Task 2

Designing ABAC policies requires rigorous logical structuring. Conflicting rules can lead to unauthorized access or denial of legitimate service.

We will draft a JSON-based ABAC policy for a cloud environment, similar to AWS IAM.
Practical Resource: Saltzer & Schroeder: Protection of Information in Computer Systems

Task 2: ABAC Policy Design

Timing: 50 minutes

You are securing a cloud-based financial API. Draft a JSON policy that implements the following requirements:

  1. Financial Analysts can read reporting data at any time.
  2. Financial Managers can write to reporting data, but only from internal corporate IP ranges (10.0.0.0/8).
  3. No one, regardless of role, can delete data if the system threat-level attribute is set to "ELEVATED".
  4. Identify and resolve any logical conflicts (e.g., Does an explicit Deny override an explicit Allow?).
Practical Resource: MITRE ATT&CK Framework

Summary & Next Steps

  • Identity management extends far beyond passwords. OAuth 2.0 and Federated Identity form the backbone of modern SSO.
  • ABAC provides the dynamic, context-aware authorization required for Zero-Trust architectures.
Next Week: Software Security (Vulnerabilities and Protections)
Practical Resource: NIST SP 800-207: Zero Trust Architecture