Jan Schoonderbeek: start

2012-11-11T23:22:21Z

start

New page

{{Maturity|3}}
{{Pageheaderbox4PatternType
|PATname=Access Security
|summary=Controls and secures (external) user connections with back-end facilities and applications
|version=0.2
|owner=J.A.H. Schoonderbeek
|sector=Infrastructure Sector Business Support
}}
Instances of this facility are used to secure access to back-end facilities.<br>
Protection can be needed for either (or both) of two reasons:
* to shield the protected facilities against unauthorized access;
* to shield the protected facilities from malicious or malformed traffic.
This pattern is often combined with [[PAT.Access Distribution|Access Distribution]]; such a combination may be realized as an "access path"
{{PAgraphic
|graphic=PAT.Access Security.png
|source=Pattern Types.vsd
|size=500px
|title=Access Security Pattern
}}
{{Pattern Type Composition}}
{{Pattern Type Composition Row
|facility=BT.Traffic Filtering
|choice=must
|reason=This facility provides the pattern with a means to reduce the attack surface of a protected facility (or a set thereof), by filtering data traffic towards and from the protected facility. Note that when filtering is ''not'' limited to traffic characteristics, then encryption and/or compression of the data transported may require the Traffic Filtering facility to use the Session Handling facility to access the data transported.
}}
{{Pattern Type Composition Row
|facility=BT.Data Scanning
|choice=may
|reason=This facility provides extra capability to Traffic Filtering by scanning the data transported. Thus, Traffic Filtering can also filter traffic on data characteristics.
}}
{{Pattern Type Composition Row
|facility=BT.Connection Handling
|choice=must
|reason=This facility terminates the user's (or client's) connection to the protected facility, and sets up its own session to that facility. This provides the Access Security pattern with the following security-related abilities:
* can access the content of encrypted sessions (e.g. SSL sessions) for inspection purposes;
* can gracefully filter session requests/answers that are malformed or deemed inappropriate for the particular protected facility (e.g. HTTP POST).
}}
{{Pattern Type Composition Row
|facility=BT.Encryption
|choice=may
|reason=Allows encrypted communication between the end user and this pattern (necessary for private communication), even when the protected facility may not be able to do this. On the other hand, allows for decrypting encrypted traffic from the end user for inspection purposes before it enters the protected facility (or vice versa).
}}
{{Pattern Type Composition Row
|facility=BT.Compression
|choice=may
|reason=Allows compressed communication between the end user and this pattern (advisable for efficient data transfer), even when the protected facility may not be able to do this. On the other hand, allows for decompressing compressed traffic from the end user for inspection purposes before it enters the protected facility (or vice versa).
}}
{{Table Ending}}
{{Pattern Type Neighbors}}
{{Pattern_Type_Adjacent_PAT_Row
|pattern=PAT.Authentication+Authorization
|choice=may
|reason=The Authentication & Authorization pattern can contain either a Permission Register, an Identity Store, or both; Access Security may use the identity store to authenticate users (usually at the location where Session Handling takes place) and/or to authorize access to the protected facilities.

Authentication can be performed at the Session Handling facility.

Authorization can take place on traffic characteristics ("firewall rules") and/or on data characteristics (e.g. "access control lists") and or other conditions (e.g. the presence of up-to-date antivirus on the client's machine).
}}
{{Pattern_Type_Adjacent_PAT_Row
|pattern=PAT.Security Management + Auditing
|choice=must
|reason=Any Access Security facility must be connected to Security Management & Auditing for central management of the security measures implemented in the Access Facility itself, but also to report security incidents to a suitable central location.
}}
{{Table Ending}}
{{PATfooter}}

PAT.Access Security - Revision history

Jan Schoonderbeek: start