The Official (ISC)2 SSCP CBK Reference. Mike Wills

CIANA+PS set of needs illustrates why information security and assurance is much more than just cybersecurity. Cybersecurity focuses intently upon the information technology aspects of keeping computers, networks, data centers, and endpoints safe, secure, and reliable. That focus on the technologies of the information infrastructure is important; it does not, however, provide much assistance in designing business processes for cross-organization collaboration that provide the appropriate assurance to each party that their knowledge, information, and data are safe and secure. Information assurance is about information risk management, which Chapter 3, “Risk Identification, Monitoring, and Analysis,” will address in more detail. Chapter 3 will also emphasize the use of physical, logical, and administrative means by which vulnerabilities are mitigated. Maintaining and operating those information assurance processes almost invariably requires a significant degree of attention to the human-facing procedural details, many of which are involved in how information systems and the IT they rely upon are managed; this is addressed in Chapter 1, “Security Operations and Administration,” as well as in Chapter 7, “Systems and Application Security.”

      This chapter, however, deals almost exclusively with the logical means of implementing identity management and access control. These logical means will involve management making decisions that establish organizational and local policies and procedures, which will be addressed here in context, but I'll leave the physical restriction of access to computing and communications hardware to Chapter 7.

ACCESS CONTROL CONCEPTS

      Access control is all about subjects and objects (see Figure 2.1). Simply put, subjects try to perform an action upon an object; that action can be reading it, changing it, executing it (if the object is a software program), or doing anything to the object. Subjects can be anything that is requesting access to or attempting to access anything in a system, whether data, metadata, or another process, for whatever purpose. Subjects can be people, software processes, devices, or services being provided by other web-based systems. Subjects are trying to do something to or with the object of their desire. Objects can be collections of information, or the processes, devices, or people who have that information and act as gatekeepers to it. This subject-object relationship is fundamental to your understanding of access control. It is a one-way relationship: objects do not “do anything” to a subject. Don't be fooled into thinking that two subjects, interacting with each other, is a special case of a bidirectional access control relationship. It is simpler, more accurate, and much more useful to see this as two one-way subject-object relationships. It's also critical to see that every task is a chain of these two-way access control relationships. It's clearer to see this as two one-way trust relationships as well.

       FIGURE 2.1 Subjects and objects

      As an example, consider the access control system itself as an object. It is a lucrative target for attackers who want to get past its protections and into the soft underbellies of the information assets, networks, and people behind its protective moat. In that light, hearing these functions referred to as data center gatekeepers makes a lot of sense. Yet the access control system is a subject that makes use of its own access control tables and of the information provided to it by requesting subjects. (You, at sign-on, are a subject providing a bundle of credential information as an object to that access control process.)

Subjects and Objects

      The first notion you have to come to grips with is just how many millions of objects can exist within even a small office/home office (SOHO) local area network (LAN) environment; scale this up to a large cloud-hosted data center operation and you could be dealing with billions and billions of objects. Even at the small end of this scale, the sheer number of objects involved dictates the need for efficient processes and effective, automated solutions to carry out most of the work that an access control system has to perform. For example, a typical SOHO LAN environment with an ISP-provided modem, a Wi-Fi router, and peer-to-peer file and resource sharing across a half-dozen devices on that LAN might have the following types of objects as part of that LAN system:

       Each hardware device; its onboard firmware, configuration parameters, or device settings; and its external physical connections to other devices

       Power conditioning and distribution equipment and cabling, such as a UPS

       The file systems on each storage device, on each computer, and on each subtree and each file within each subtree

       All of the removable storage devices and media, such as USB drives, DVDs, or CDs used for backup or working storage

       Each installed application on each device

       Each defined user identity on each device and the authentication information that goes with that user identity, such as username and password

       Each person who is a user or is attempting to be a user (whether as guest or otherwise)

       Accounts at all online resources used by people in this organization and the access information associated with those accounts

       The random access memory (RAM) in each computer, as free memory

       The RAM in each computer allocated to each running application, process, process thread, or other software element

       The communications interfaces to the ISP, plain old telephone service, or other media

      Wi-Fi is a registered trademark of the Wi-Fi Alliance, the nonprofit organization that promotes wireless connectivity, certifies products as conforming to their standards for interoperability. The name does not stand for anything; in particular, it does not mean “wireless fidelity,” even though a number of websites say that it does.

Note that third item: on a typical Windows 10 laptop with 330GB of files and installed software on a 500GB drive, that's only half a million files—and each of those, as well as each of the 100,000 or so folders in that directory space, is an object. Those USB drives, and any cloud-based file storage, could add similar amounts of objects for each computer; mobile phones using the Wi-Fi might not have quite so many objects on them to worry about. A conservative upper bound might be 10 million objects.

      What might the population of subjects be, in this same SOHO office?

       Each human, including visitors, clients, family, or even the janitorial crew

       Each user ID for each human

       Each hardware device, including each removable disk

       Each mobile device each human might bring into the SOHO physical location with them

       Each executing application, process, process thread, or other software element that the operating system (of the device it's on) can grant CPU time to

       Any software processes running elsewhere on the Internet, which establish or can establish connections to objects on any of the SOHO LAN systems

      That same Windows 10 laptop, by the way, shows 8 apps, 107 background processes, 101 Windows processes, and 305 services currently able to run—loaded in memory, available to Windows to dispatch to execute, and almost every one of them connected by Windows to events so that hardware actions (such as moving a mouse) or software actions (such as an Internet Control Message Protocol packet) hitting a system's network interface card will wake them up and let them run. That's 521 pieces of executing