Access control and markup languages

Organizations need a way to control how their information is used internally within their applications. Extensible Markup Language (XML) is the standard that provides the meta data structures to allow this expression of data. Organizations need to be able to communicate their information, and since XML is a global standard, as long as they both follow the XML rules, they can exchange data back and forth.Users on the sender’s side need to be able to access services on the receiver’s side, which the Service Provisioning Markup Language (SPML) provides. The receiving side needs to make sure the user who is making the request is properly authenticated by the sending company before allowing access to the requested service, which is provided by the Security Assertion Markup Language (SAML). To ensure that the sending and receiving companies follow the same security rules, they must follow the same security policies, which is the functionality that the extensible Access Control Markup Language (XACML) provides.

Simple Object Access Protocol, is a protocol specification for exchanging structured information in the implementation of Web Services in computer networks. It relies on Extensible Markup Language (XML) for its message format, and usually relies on other Application Layer protocols, most notably Remote Procedure Call (RPC) and Hypertext Transfer Protocol (HTTP), for message negotiation and transmission.

This XML based protocol consists of three parts: an envelope(which defines what is in the message and how to process it),header and body.

   
 
   
 

Access control

Access control is what subject can control what objects and what type of commands and operations they can carry out.

Access control categories:

• Administrative controls (personal controls, Supervisory structure, security awareness training, testing)
• Physical controls ( Network segregation, Perimeter Security, Computer controls, work area separation, cabling, control zones)
• Technical controls (System access, network architecture, Network access, encryption and protocols, auditing)

Access control types

• Preventive - keep undesirable events form happening
• Detective - identify undesirable events that have taken place
• Corrective - correct undesirable events that have taken place
• Deterrent - Discourage security violations form taking place (we are serious about security "Beware of dogs")
• Recovery - Restore resources and capabilities after a violation or accident
• Compensation - provide alternatives to other controls (based on cost/benefit analysis)

Process of getting access in to the system

• Identification - publicly known information but shouldn't be descriptive(username, userID)
• Authentication - Something you know(password,pin),something you have(smartcard,token) and something you are(biometrics). Strong authentication is two of authentication components.
• Authorization - ACL
• Accountability

It is important to asses the your passwords by trying to crack the password your self using the tools available. Password can be cracked using dictionary attack and exhaustive attacks.Rainbow table make password cracking easier by machining hash values. As solution for this we can use one time passwords with a authentication server(challenge response authentication).

Smart cards are good method of authentication.There are two types of smart cards, contact and contact(in/out chip) less(small antenna inside). Fault generation is one of the attack against smart card. Fault generation is manipulating the something outside the card(reader) to get into the data in smart card. Then there are software attacks exploiting the software flaws inside the card. Side channel attack means we are not doing anything to the card, just watch and gather information(gathering radiation, time it took to authenticate).Micro probing is connecting to the circuits directing by peeling of the chip on the card.

Data classification and clearance

Data classification is really important in the industry. There are lot of news in security leakages due to poor data classification.In the military data classification and clearance has higher importance. In military they classify data as unclassified data, confidential data, secret data and top secret data. why we don't call all the data top secret and consider it done. If we do so we waste cost in putting unnecessary security measures and waste lot of man power in managing them. So it is really important to design data classification model appropriate to our industry.Also it is important to define the security clearance.we have to define who are the data owners, what are their responsibilities and data classification in the organization. To start we should build a security policy which outline everything that we decided upon.Then we have our procedures, guidelines and standards to define it further.

Too many classification levels are impractical and add confusion. Too few classification levels gives the perception of little value and use. And there should be no overlap between classification levels.It is very common that lot of companies have three classification levels.Also we should follow a standardize approach for our information classification criteria.

Weakest link in security is people.That's why employ management is really important when you look in at enterprise security.80% of threat are internal and 20% are external(80/20 rule).People make mistakes.Policies should enforce in recruiting people, firing people and security training.

Hiring and Firing procedures:

Pre employment

• Background check
• security clearance
• Credit check
• drug screening

Termination procedures:

• Complete an exit interview (review non-disclosure agreement)
• Individual must surrender ID, keys and company assets
• User's accounts must be disabled

Want to be a Database administrator

A personal database is typically maintained by the individual who owns it and uses it. However, corporate or enterprise-wide databases are typically important enough and complex enough that the task of designing and maintaining the database is entrusted to a professional, called the database administrator (DBA).

The DBA is responsible for many critical tasks:

• Design of the Conceptual and Physical Schemas - Based on the user's requirment, the DBA must design the conceptual schema (decide what relations to store) and the physical schema (decide how to store them).
• Security and Authorization: The DBA is responsible for ensuring that unauthorized data access is not permitted
• Data Availability and Recovery from Failures: The DBA must take steps to ensure that if the system fails, users can continue to access as much of the uncorrupted data as possible.DBA is responsible for implementing procedures to back up the data periodically and maintain logs of system activity (to facilitate recovery from a crash).
• Database Tuning: Users' needs are likely to evolve with time. The DBA is responsible for modifying the database, in particular the conceptual and physical schemas, to ensure adequate performance as requirements change.

Features of DBMS

A very important advantage of using a DBMS is that it offers data independence.Application programs are insulated from changes in the way the data is structured and stored.users can be shielded from changes in the logical structure of the data, or changes in the choice of relations to be stored. This property is called logical data independence.the conceptual schema insulates users from changes in physical storage details. This property is referred to as physical data independence.

A DBMS provides a specialized language, called the query language, in which queries can be posed.

Query languages:

• Relational calculus- based on mathematical logic, and queries in this language have an intuitive, precise meaning. 
• Relational algebra-based on a collection of operators for manipulating relations

A DBMS enables users to create, modify, and query data through a data manipulation language (DML). Thus, the query language is only one part of the DML, which also provides constructs to insert, delete, and modify data. Let's discuss the DML features of SQL in a later blog post.

An important task of a DBMS is to schedule concurrent accesses to data so that each user can safely ignore the fact that others are accessing the data concurrently.A locking protocol is a set of rules to be followed by each transaction.A lock is a mechanism used to control access to database objects.Two kinds of locks are commonly supported by a DBMS: 

• Shared locks on an object can be held by two different transactions at the same time
• Exclusive lock on an object ensures that no other transactions hold any lock on this object

A DBMS must ensure that the changes made by incomplete transactions(system interruption,crashes) are removed from the database.To do so, the DBMS maintains a log of all writes to the database.A crucial property of the log is that each write action must be recorded in the log (on disk) before the corresponding change is reflected in the database itself.This property is called Write-Ahead Log, or WAL.

Introduction to Database

What is a database? A database is a collection of structured data. A database captures an abstract representation of the domain of an application.

• Typically organized as “records” called as entities
• and relationships between records

A DBMS is a (usually complex) piece of software that sits in front of a collection of data, and mediates applications accesses to the data, guaranteeing many properties about the data and the accesses.A data model is a collection of high-level data description constructs that hide many low-level storage details. A DBMS allows a user to define the data to be stored in terms of a data model. Most database management systems today are based on the relational data model.A widely used semantic data model called the entity-relationship (ER) model allows us to pictorially denote entities and the relationships among them.

A description of data in terms of a data model is called a schema.In the relational model, the schema for a relation specifies its name, the name of each field (or attribute or column), and the type of each field.

In addition to the relational data model (which is used in numerous systems, including IBM's DB2, Informix, Oracle, Sybase, Microsoft's Access, FoxBase, Paradox, Tandem, and Teradata), other important data models include ,

• Hierarchical model (e.g., used in IBM's IMS DBMS)
• Network model (e.g., used in IDS and IDMS)
• Object-oriented model (e.g., used in Objectstore and Versant)
• Object-relational model (e.g., used in DBMS products from IBM, Informix, ObjectStore, Oracle, Versant, and others).

The database description consists of a schema at each of these three levels of abstraction:  

• Conceptual Schema : Describes the stored data in terms of the data model of the DBMS.Describes all relations that are stored in the database
• Physical Schema : specifies additional storage details.summarizes how the relations described in the conceptual schema are actually stored on secondary storage devices such as disks.
• External Schema :allows data access to be customized (and authorized) at the level of individual users or groups of users

A data definition language (DDL) is used to define the external and coneeptual schemas (SQL is a well known DDL).The process of arriving at a good physical schema is called physical database design.The process of arriving at a good conceptual schema is called conceptual database esign.

Enterprise security architecture

Layered approach : provide layers of defense that the attacker has to break before accessing an asset

Industries follow this approach and then think their system is secure. But they forget that the remote access and wireless network doesn't have enough layers in position. Security requirement can be identified as functional requirements and assurance requirements.Organization choose to be certified against the BS7799 standard to provide confidence to their customer base and partners. That is why industries make effort to comply with these standards.

Sometime numbering of the IT security standards are confusing.BS7799 security standard has two parts. After ISO took BS7799 under their wings, they introduced their own numbering.

BS7799 part 1 - ISO17799 outlines control objectives and a range of controls that can be used to meet those objectives
BS7799 part 2 - ISO27001 outlines how a security program can be setup and maintained.

COBIT defines the method of building the IT inf structure. COBIT is control objective for information related technology.this is not just about security.COBIT is a whole structure how to set up IT infrastructure. In COBIT there are four domains ;

1. Planning and Organization
2. Acquisition and implementation
3. delivery and support
4. Monitoring

In security we are just looking at the delivery and support domain.COBIT is great but it is really time consuming to implement.For security professional there are special things to learn form COBIT

• Management of IT security
• IT security plan
• Identity management
• User account management
• Security testing,surveillance and monitoring

Whole point of COBIT is keep IT alignment with business.It has performance indicators and define goals.COBIT is a very high level approach to the information security. That's how the auditors look at. They look at the control objective and check whether the control is in place.

security governance is that security is controlled by not just IT but with board members and senior management.Everybody who suppose to be involved should involve in the security.Security policy, standards, baseline, guideline and procedures have to act together to realize strong security.

Data owner is the person who responsible for protecting the data.custodian usually the IT department to the actual security setup to make sure it meet that protection level.