Implementing NIST – Access Control - Access Control Decisions

Overview

Based on NIST 800-53 – AC-24, it’s recommended to implement procedures that ensure access control decisions are applied to each access request before access decisions are enforced. Additionally, information systems should securely transmit information relating to access authorisations and where feasible, do not include the identity of the user or process acting on behalf of a user.

How to implement Access Control Decisions

Businesses must first adopt an access control method based on their business case and then apply restrictive controls to only allow what is needed. Below are some common access control methods:

• Role-based Access Control (RBAC)
• Attribute-Based Access Control (ABAC)
• Mandatory Access Control (MAC)
• ACL (Access Control List)
• Discretionary Access Control (DAC)

When implementing access control methods, it’s important to use encrypted channels to communicate access control data. Below are some protocols which support encrypted communications:

• HTTPS (Hypertext Transfer Protocol Secure)
• SSH (Secure Shell)
• FTPS (FTP over SSL)
• SFTP (SSH File Transfer Protocol or FTP over SSH)

How to verify Access Control Decisions is implemented

Below are some ways to check if this control is implemented securely.

1. Inspect traffic using a proxy to determine if unnecessary attributes are being transmitted.
2. Launch security tests that try to misuse or abuse access control decision data. The tests will highlight security gaps in the implementation that may lead to a compromise.

You may alternatively schedule a consultation at the following page: g5cybersecurity.com/meeting or explore your service further at g5cybersecurity.com/services.

Why implement Access Control Decisions

Protecting access authorisation data minimises the risk of data being altered, spoofed, or otherwise compromised during transmission.

References and resources

References:

• NIST Special Publication 800-53 - Security and Privacy Controls for Federal Information – AC 24 - 

Additional resources on this topic:

• https://dinolai.com - Authorization Models
• Imperva - Role-Based Access Control (RBAC)
• Stack Exchange - MAC vs DAC vs RBAC
• Identity Automation - RBAC vs ABAC Access Control Models - IAM Explained

Resources for Security assessors:

• packetlabs.net - Broken Access Control: Hidden Exposure for Sensitive Data
• OWASP - A5-Broken Access Control
• OWASP - Broken_Access_Control
• OWASP - Access Control
• OWASP - Access Control Cheat Sheet