InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Understanding authorization mechanisms, access control models, permission systems, and the principle of least privilege for controlling what authenticated users can do within systems.
What is Authorization?
Authorization is the process of determining what an authenticated user, service, or system is permitted to do. While authentication answers "who are you?", authorization answers "what are you allowed to do?"
Authentication vs Authorization
==================================
User: "I am Alice" → Authentication (verify identity)
System: "Alice can read files, but cannot delete them" → Authorization
Flow
Identification → Authentication → Authorization → Access
"I am Alice" "Prove it" "Check perms" "Granted/Denied"
Authorization Models
1. Access Control Lists (ACL)
ACLs associate permissions directly with resources:
| Subject | Read | Write | Delete |
|---|---|---|---|
| Alice | ✓ | ✓ | ✓ |
| Bob | ✓ | ✓ | ✗ |
| Charlie | ✓ | ✗ | ✗ |
| Everyone | ✗ | ✗ | ✗ |
ACL
2. Role-Based Access Control (RBAC)
Users are assigned roles, and roles have permissions:
Example
class RBACSystem:
"""Role-Based Access Control implementation."""
def __init__(self):
self.roles = {
"admin": {
"permissions": ["create", "read", "update", "delete", "manage_users"],
"description": "Full system access"
},
"manager": {
"permissions": ["create", "read", "update", "view_reports"],
"description": "Department management access"
},
"analyst": {
"permissions": ["read", "create_report", "view_reports"],
"description": "Read and reporting access"
},
"viewer": {
"permissions": ["read"],
"description": "Read-only access"
}
}
self.user_roles = {
"alice": ["admin"],
"bob": ["manager", "analyst"],
"charlie": ["viewer"]
}
def check_permission(self, user: str, action: str, resource: str) -> dict:
"""Check if user has permission to perform action."""
user_roles = self.user_roles.get(user, [])
for role in user_roles:
role_perms = self.roles.get(role, {}).get("permissions", [])
if action in role_perms:
return {
"allowed": True,
"user": user,
"action": action,
"resource": resource,
"granted_by_role": role
}
return {
"allowed": False,
"user": user,
"action": action,
"resource": resource,
"reason": f"No role grants '{action}' permission"
}
def get_effective_permissions(self, user: str) -> set:
"""Get all permissions for a user across all their roles."""
permissions = set()
for role in self.user_roles.get(user, []):
permissions.update(self.roles[role]["permissions"])
return permissions
# Example usage
rbac = RBACSystem()
# Check permissions
print(rbac.check_permission("alice", "delete", "report.pdf"))
print(rbac.check_permission("charlie", "delete", "report.pdf"))
print(f"\nBob's effective permissions: {rbac.get_effective_permissions('bob')}")
3. Attribute-Based Access Control (ABAC)
Decisions based on attributes of user, resource, action, and environment:
Example
from datetime import datetime
class ABACSystem:
"""Attribute-Based Access Control with policy evaluation."""
def __init__(self):
self.policies = []
def add_policy(self, name: str, condition_func, effect: str = "allow"):
"""Add an ABAC policy rule."""
self.policies.append({
"name": name,
"condition": condition_func,
"effect": effect
})
def evaluate(self, subject: dict, resource: dict,
action: str, environment: dict) -> dict:
"""Evaluate all policies for an access request."""
context = {
"subject": subject,
"resource": resource,
"action": action,
"environment": environment
}
applicable_policies = []
for policy in self.policies:
if policy["condition"](context):
applicable_policies.append(policy)
# Default deny - any explicit deny overrides allows
for policy in applicable_policies:
if policy["effect"] == "deny":
return {"allowed": False, "policy": policy["name"]}
for policy in applicable_policies:
if policy["effect"] == "allow":
return {"allowed": True, "policy": policy["name"]}
return {"allowed": False, "policy": "default_deny"}
# Setup ABAC system
abac = ABACSystem()
# Policy: Managers can approve expenses under $10,000
abac.add_policy(
"manager_expense_approval",
lambda ctx: (
ctx["subject"].get("role") == "manager" and
ctx["action"] == "approve" and
ctx["resource"].get("type") == "expense" and
ctx["resource"].get("amount", 0) < 10000
),
"allow"
)
# Policy: No access outside business hours for non-admins
abac.add_policy(
"business_hours_only",
lambda ctx: (
ctx["subject"].get("role") != "admin" and
not (9 <= ctx["environment"].get("hour", 12) <= 17)
),
"deny"
)
# Test evaluation
result = abac.evaluate(
subject={"name": "Bob", "role": "manager", "department": "finance"},
resource={"type": "expense", "amount": 5000, "id": "EXP-123"},
action="approve",
environment={"hour": 14, "ip": "192.168.1.100", "location": "office"}
)
print(f"Access decision: {result}")
The Principle of Least Privilege
The cornerstone of authorization is granting the minimum permissions necessary:
Least Privilege Implementation
=================================
Bad Practice (Overprivileged)
Developer → Role: admin → All permissions on everything
Good Practice (Least Privilege)
Developer → Role: dev_team_a → {
read: [source_code, docs]
write: [source_code (own repos only)]
deploy: [staging environment only]
NO access to: production, customer_data, billing
}
Privilege Escalation Path (what attackers exploit)
Low-privilege account → Vulnerability → Higher privileges
Prevention
- Regular access reviews
- Just-In-Time (JIT) access
- Privileged Access Management (PAM)
- Separation of duties
Authorization in APIs
python example
from functools import wraps
def require_permission(permission):
"""Decorator for API endpoint authorization."""
def decorator(func):
@wraps(func)
def wrapper(request, *args, **kwargs):
user = request.authenticated_user
if not user:
return {"status": 401, "error": "Authentication required"}
if permission not in user.permissions:
return {
"status": 403,
"error": f"Forbidden: requires '{permission}' permission"
}
return func(request, *args, **kwargs)
return wrapper
return decorator
# Usage in API endpoints
# @require_permission("users:read")
# def get_users(request):
# return {"users": User.find_all()}
# @require_permission("users:delete")
# def delete_user(request, user_id):
# User.delete(user_id)
# return {"status": "deleted"}Common Authorization Vulnerabilities
| Vulnerability | Description | Prevention |
|---|---|---|
| IDOR (Insecure Direct Object Reference) | Accessing other users' resources by changing IDs | Verify ownership in every request |
| Privilege Escalation | Gaining higher permissions than assigned | Validate roles server-side, input validation |
| Missing Function-Level Access Control | Admin endpoints accessible without checks | Centralized authorization middleware |
| Path Traversal | Accessing files outside authorized directory | Canonicalize paths, whitelist approach |
| JWT Manipulation | Altering token claims to gain permissions | Validate signatures, use short expiry |
Interview Questions
- What is the difference between RBAC and ABAC?
- RBAC assigns permissions based on user roles (static). ABAC evaluates multiple attributes (user, resource, environment, action) against policies (dynamic). ABAC is more flexible and granular but more complex to manage.
- Explain the Principle of Least Privilege with a real-world example.
- A database administrator needs access to manage database schemas but should not have access to read customer PII. Using least privilege, they get DBA tools access without SELECT permission on sensitive tables. This limits damage if their account is compromised.
- What is an IDOR vulnerability and how do you prevent it?
- IDOR (Insecure Direct Object Reference) allows users to access resources by manipulating identifiers (e.g., changing /api/orders/123 to /api/orders/456). Prevention: Always verify the authenticated user owns or has permission to access the requested resource.
- How do you implement authorization in a microservices architecture?
- Options include: API Gateway with centralized policy enforcement, JWT tokens containing roles/permissions validated by each service, service mesh with mutual TLS and authorization policies, or a dedicated authorization service (like OPA/Open Policy Agent) queried by services.
- What is separation of duties and why is it important?
- Separation of duties ensures no single person can complete a critical action alone. Example: The person who writes a check cannot also approve it. This prevents fraud and reduces the risk of insider threats by requiring collusion between multiple parties.
Summary
Authorization is the enforcement layer that ensures authenticated users can only perform actions appropriate to their role and context. Proper authorization implementation — using least privilege, appropriate access control models, and regular reviews — is essential for preventing unauthorized access and data breaches.
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for Authorization in Information Security.
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this Information Security topic.
Search Terms
information-security, information security, information, security, fundamentals, authorization, authorization in information security
Related Information Security Topics
Continue learning this concept
Security FundamentalsAccountability in Information SecurityUnderstanding accountability principles in information security including audit trails, logging, monitoring, non-repudiation mechanisms, and how to establish responsibility for security actions.Security FundamentalsAuthentication in Information SecurityComplete guide to authentication mechanisms including passwords, multi-factor authentication, biometrics, tokens, and modern passwordless approaches for verifying user identity.Security FundamentalsAvailability in Information SecurityUnderstanding the availability principle of the CIA Triad, including redundancy strategies, disaster recovery, DDoS protection, and ensuring systems remain accessible to authorized users when needed.Security FundamentalsConfidentiality in Information SecurityDeep dive into the confidentiality principle of the CIA Triad, exploring encryption methods, access controls, data classification, and practical implementations to protect sensitive information from unauthorized disclosure.Security FundamentalsIntegrity in Information SecurityComprehensive guide to the integrity principle of the CIA Triad, covering hash functions, digital signatures, checksums, database integrity, and techniques to detect and prevent unauthorized data modification.Security FundamentalsNon-Repudiation in Information SecurityUnderstanding non-repudiation as a security service that provides undeniable proof of origin, delivery, or action, covering digital signatures, timestamps, and legal frameworks.