- Cybersecurity
- CIA-DAD
- I-A-A-A
- Defense in Depth
- Hardware and Software Security
- Firewalls, Access Controls, and Access Control Lists
- Physical Security
- Practical Example of a Server Security in an Organization
- Summary
- Chapter 1 Questions
- Answers to Chapter 1 Questions
This chapter is from the book
This chapter is from the book
This chapter is from the book
Firewalls, Access Controls, and Access Control Lists
Firewalls and access control lists (ACL) are either software or hardware. Firewalls have rules that can be set up, edited, or changed depending on the requirements. While blocking traffic, ACLs allow some traffic based on a routing table or some other rule. A default firewall rule that allows all traffic should always be at the bottom of a rules list after filtering out most of the traffic with various other rules. However, you have to make sure the rules are set up rather than assuming that they are already set up. Setting up rules alone would not complete the security of a system or software. The gist is to check the firewall logs on a daily basis to find any activity or noise that is trying to cause any trouble.
ACLs are a set of inbound and outbound rules defined for controlling network traffic to grant or deny access to certain digital environments such as files and networks. ACLs use this set of rules to filter traffic or limit user access.
ACLs are mainly two types: filesystem ACL and networking ACL. Filesystem ACL limits access privileges to files and/or directories, and they work at the operating system level to tell which users can access the system and files and what they can do with those files (read/write/execute). Networking ACLs work on the computer network that contains routers, switches, and other equipment, and they decide which type of traffic can flow on the network and which activity is denied (implicitly or explicitly). In either type of ACL , a log is created when a user tries to access the resources. The log is helpful for the system administrator to check what is happening on the organizational files and network resources.
An organization dealing with various products can also implement an ACL in their offices for physical access. Physical access is decided by the clearance levels required to access an asset (“the need to know”). For example, even the most experienced programmer who worked for 10 years in an organization may not need to enter the data room where the physical machines are stored for data storage. Likewise, most employees don’t need to access a plenum space in an office, prohibited areas, print servers, or the fire/water safety controllers or the HVAC room. These factors of who can access what is usually decided by the company, with least privilege and need-to-know rules depending on the policies set by the company’s data custodians and its CEO.