Welcome to this course. Access is one of the most exploited aspects of security because it is the gateway that leads to critical assets. Access controls need to be applied in a layered defense-indepth method, and an understanding of how these controls are exploited is extremely important. In this course we will explore access control conceptually and then dig into the technologies the industry puts in place to enforce these concepts. We will also look at the common methods the bad guys use to attack these technologies.

Access controls are security features that control how users and systems communicate and interact with other systems and resources. They protect the systems and resources from unauthorized access and can be components that participate in determining the level of authorization after an authentication procedure has successfully completed. Although we usually think of a user as the entity that requires access to a network resource or information, there are many other types of entities that require access to other network entities and resources that are subject to access control. It is important to understand the definition of a subject and an object when working in the context of access control.

In this course, you'll learn:

• Identity as a service

• Identification methods and technologies

• Authentication methods, models, and technologies

• Discretionary, mandatory, and nondiscretionary models

• Accountability, monitoring, and auditing practices

• Registration and proof of identity

• Threats to access control practices and technologies