All language subtitles for 005 Identity and Access Management II_en

So let's start with part two of identity and access management.

We'll discuss authorisation and accountability first.

So authorisation decides who is allowed to perform what, for example, on a system, you can create

different groups of users, you can have normal users who can only view their account.

Then you can have administrators who can create view and delete user accounts.

However, these are broad categories.

So you have divided users into broad categories and those categories have predefined privileges.

You can even be more fine grained with your authorization.

You can go down to the file level and see that if a user accesses a file, whether he has appropriate

permissions or not.

So if a user tries to write on a file on which he has only read only access, then that won't work.

Accountability refers to logging user activities for accountability because, remember, accountability

can only be done once a user has been identified and authenticated because only then will you have non

repudiation.

Now, this is done through audits of logs and accounts to identify any violations.

Need to know is an important concept in authorization, the basic idea is that you should always give

a subject the minimum amount of data or information that he or she needs to complete their job.

Now, this ensures that every subject has got the least privileges that he or she need to complete the

job duties.

It's the fundamental idea in cybersecurity to provide least privileges.

As an example, let's say you have an administrator who has an almost universal access to different

parts of your system.

He can even create, modify or delete user accounts and he can manage a lot of different databases.

Does he really need to be able to view employee salary information?

So that's the question.

You only give privileges which are actually required by that person to fulfill his job.

You should limit the privileges to a minimum.

Similarly, if you have a user who needs to read a file in order to perform the job duties, you should

only give read-only access.

You should not give, read and write access because these type of privileges, if they are left unchecked,

they can cause serious cybersecurity repercussions.

Later on, they can be abused.

Another important concept in organizations is privilege creep, this happens when someone accumulates

privileges over time as the rule changes or as they move vertically up the organization.

However, ideally, whenever someone gets new responsibilities, they get new privileges, but their

old privileges should be reviewed and revoked accordingly.

But this doesn't happen often.

So an example could be you have a sales assistant who moves on to become network administrator and then

a security administrator, but he still retains privileges to access the sale systems despite his lack

of need to do so.

Now, this usually happens because organizations don't have accountability processes in place.

Now accountability basically refers to holding people responsible for their actions.

This is enforced through log audits, account audits and an interesting concept, which is job rotation.

So the basic idea of job rotation is that once in a while you rotate people among jobs.

The problem stems from the fact that if there is someone who has been performing a role for a very long

time, it is difficult to obtain visibility into what exactly is he doing or if he is, you know, violating

any rules.

But when you rotate people once in a while, this allows for the new employee or a different employee

to gain visibility into the actions of the predecessor.

And this can sometimes expose problems.

Now, please remember, accountability can only be enforced if we have non-repudiation, that the subject

must have done identification and authentication.

Only then we can be sure that it was specifically the subject which was performing this task.

There are a number of sources of information which can help with the accountability process, for example,

if you have network logs which contain routers, switches, logs, that can be firewall logs, now they

can show if a user has, for example, visited a particular Web site.

What are the sessions, created by that user and so on.

We also have database logs which basically log and monitor queries recorded, files accessed and any

modifications.

So, for example, if a part of your sensitive database has been modified or deleted, you can simply

refer to database logs and see which user executed those queries.

Similarly, we have application logs which basically record exceptions, crashes and anomalies.

So if you have an inside user who's trying to crash your Web server, he's definitely going to leave

a footprint in application logs.

Similarly, you have system logs which refer to recorded information at the end stations.

This refers to any resources used, any applications executed.

This can even expose if a user has installed applications which were otherwise prohibited according

to the organization's policy.

This concludes our lecture.

I'll see you in the next one.