Section 11.2: Access Control & Encryption

Authentication vs. Authorization

Before exploring access control models, it is essential to distinguish between two foundational security processes: Authentication (AuthN) and Authorization (AuthZ).

• Authentication is the process of verifying the identity of a user, system, or application (e.g., "Are you who you claim to be?"). This is typically achieved using credentials such as usernames and passwords, cryptographic tokens, or biometrics.
• Authorization is the process of determining what resources or actions an authenticated identity is permitted to access (e.g., "What are you allowed to do?"). Access control models focus primarily on authorization.

---

Access Control Models

Organizations utilize different access control models to manage permissions. The two primary models defined in data security architecture are Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC).

Role-Based Access Control (RBAC)

In Role-Based Access Control (RBAC), access permissions are assigned to specific business roles rather than individual users. Users are assigned to one or more roles based on their job functions.

• Advantage: It simplifies administration because when employees change jobs, administrators only need to change their role assignment rather than adjusting individual resource permissions.
• Disadvantage: It can lead to role explosion, a scenario where an organization creates too many unique, highly granular roles (e.g., "HR Analyst Department 4 North") to accommodate specific exceptions, making management difficult.

Attribute-Based Access Control (ABAC)

In Attribute-Based Access Control (ABAC), access permissions are evaluated dynamically at runtime based on a set of rules and attributes:

1. User Attributes: Job title, department, security clearance, or certifications.
2. Resource Attributes: Data classification level, creation date, department owner, or file type.
3. Environmental/Context Attributes: Time of day, geographical location (IP address), device security status, or connection type.
4. Action Attributes: Read, write, execute, or delete.

• Advantage: Highly flexible, fine-grained, and avoids role explosion.
• Disadvantage: Requires greater computational overhead to evaluate policies dynamically on every request.

---

Cryptography: Encryption at Rest vs. In Transit

Cryptography is the practice of securing information by transforming it into an unreadable format (ciphertext). When authorized parties want to read the data, they decrypt it back into its original format (plaintext) using a cryptographic key.

Encryption at Rest

Encryption at Rest protects data stored on physical media, such as hard drives, databases, solid-state drives, backups, and cloud storage buckets.

• Purpose: To prevent data exposure if physical storage drives are stolen, or if database backup files are leaked.
• Common Standards: The industry standard is the Advanced Encryption Standard (AES), typically using a 256-bit key length (AES-256), which is a symmetric key algorithm.
• Key Management: The biggest challenge of encryption at rest is secure key management. If keys are stored alongside the encrypted data, the encryption is useless. Organizations use Key Management Systems (KMS) or hardware-based Hardware Security Modules (HSMs) to generate, store, rotate, and destroy keys.

Encryption in Transit

Encryption in Transit (also known as encryption in flight) protects data as it moves across networks, such as the Internet or internal enterprise networks.

• Purpose: To prevent eavesdropping, intercepting, or modifying data during transmission (Man-in-the-Middle attacks).
• Common Standards: Secure network transmissions rely on Transport Layer Security (TLS) (which has replaced the deprecated Secure Sockets Layer [SSL]). TLS establishes an encrypted session via a handshake using public-key cryptography (asymmetric) and then switches to symmetric encryption for faster data transfer.

---

Advanced Data Protection Techniques

In addition to encryption, several techniques are used to secure data based on use cases:

Hashing

Hashing is the process of mapping data of arbitrary size to a fixed-size string of characters using a mathematical algorithm (such as SHA-256). Hashing is a one-way function, meaning it is mathematically impossible to reverse the hash to retrieve the original plaintext.

• Salting: To prevent attackers from using precomputed lookup tables (rainbow tables) to crack hashes, a random string called a salt is appended to the plaintext before hashing.
• Use Cases: Verifying data integrity (detecting tampering) and storing passwords securely.

Dynamic Data Masking (DDM)

Dynamic Data Masking (DDM) is a security control that hides sensitive data on the fly as it is queried, without altering the underlying data on the disk.

• How it Works: A query engine intercepts the database query. If the user does not have permissions to view sensitive data, the database returns masked values (e.g., masking credit card digits XXXX-XXXX-XXXX-4321 or a phone number XXX-XXX-1234).
• Use Cases: Customer service agents viewing account profiles, or developers querying production database replicas.

Tokenization

Tokenization is the process of replacing sensitive data with a non-sensitive surrogate value called a token.

• How it Works: Unlike encryption, which uses mathematical algorithms to transform data, tokenization maps the sensitive data to a randomly generated token and stores the mapping in a highly secure, centralized database called a token vault.
• Use Cases: Tokenization is widely used in payment card processing. The merchant stores only the token, reducing the scope of Payment Card Industry Data Security Standard (PCI-DSS) audits because the merchant's tokenized databases do not hold actual cardholder data.