Advanced Information Systems Security
Q1
There are different Access control models and they include Role Based Access Control (RBAC), Rule Based Access Control (RB-RBAC), Mandatory Access Control (MAC), and Discretionary Access Control (DAC). The RB-RBAC mainly gives roles to different users on the basis of the criteria defined by the system administrator. Unlike RBAC, the MAC model only assigns the owner and custodian management of the access control (Benantar, 2016). Compared to MAC, which is considered the most restrictive model, the DAC is the least restrictive as it gives a person total control over any objects they own coupled with the programs linked to those objects. The RBAC offers access control on the basis of the position a person fills in an organization. I have used the RB-RBAC and I was only permitted to access files during particular hours of the day.
Q2
Multifactor authentication derives its name from the utilization of numerous authentication factors. There are 3 different authentication factors that can be utilized, and they include something one knows, something one has and something one is (Vacca, 2019). Something one knows could be a PIN, password, or some other personal information. Something one has could be a smartcard, one-time-use token, a key, bank card, or some other object a person might have in their physical possession. Something one is could be one’s biometric identity such as voice, fingerprint, eye iris, or a speech pattern.
Q3
RADIUS denotes to a networking procedure on port 1812 that offers centralized authentication, authorization and accounting management for users who link and utilize a network service. TACTACS is an authentication procedure that permits a remote access server to forward the logon password of a user to an authentication server to establish if access can be permitted to a given system. DIAMETER is a protocol utilized to exchange authentication, authorization and accounting info in IP multimedia systems and Long-Term Evolution networks.
Advantages
• No actual sole point of failure
• Resilience
• Low data transfer costs
• Lower latency
Disadvantages
• Loss of control of activities of the administration
• Work duplication
References
Benantar, M. (2016). Access Control Systems: Security, Identity Management and Trust Models. Springer Science & Business Media.
Vacca, J. R. (2019). Computer and Information Security Handbook. Morgan Kaufmann.
