5.2 Protecting Applications and Data: Managerial Controls and Access Controls

Data at rest is stored on a drive: protect the drive from theft or destruction, and encrypt the data. Data in transit is moving between devices: protect the cables or other media, and encrypt the data. Data in use is being worked on by software or a person: it must be decrypted to be used, so access controls decide who can view or edit it.

Organizations rank data by sensitivity and protect the most sensitive data most. Laws and industry rules also require some data to be stored, sent and handled in specific ways, so organizations label regulated data and write policies to comply:

• Personally identifiable information (PII) identifies a person: name, signature, phone number, address, biometrics, Social Security number, birthdate, email. Laws include the Privacy Act of 1974 (records held by federal agencies) and, for children under 13, the Children's Online Privacy Protection Act (COPPA) of 1998.
• Protected health information (PHI) covers health, treatment and payment for care: test results, treatment and hospital records, doctor's notes, billing records. It's protected under HIPAA (the Health Insurance Portability and Accountability Act of 1996).
• Payment card information (PCI) is what's needed to process card payments: name, account number, expiration date, address and CVV code. It's governed by the Payment Card Industry Data Security Standard (PCI DSS), an industry standard rather than a law.

A cryptography policy lists approved encryption algorithms for each use, minimum or maximum key lengths, and rules for generating and storing keys. A web application security policy says when an app must get a security assessment, how fast flaws must be fixed based on risk, and how assessments are done (which tools or frameworks).

Access control decides which subjects (users or programs) can perform which operations (read, change, add, remove) on which objects (files or programs).

• Role-based (RBAC): each subject gets a role, and roles get access. Only people in the role "nurse" can open the medication app.
• Rule-based (RuBAC): access is checked against rules, like time of day or network location, usually layered on top of another model. No one can open the grading system after 10 p.m., even teachers.
• Discretionary (DAC): owners decide who can access what they own, and administrators can override. You share your document with one friend as editor and another as viewer.
• Mandatory (MAC): an outside administrator assigns levels to every subject and object, and strict rules govern access across levels. The Bell-LaPadula model, used by governments and militaries, says you may not read above your level and may not write below it: "write up, read down."
• Least privilege: give every user and program exactly the access its job needs, and no more.

Authorization means granting someone a certain type of access to a resource. Linux sets three permissions, always in this order: read (r), write (w) and execute (x, run a program). A dash means the permission is missing, so r-x is read and execute without write. They're set for three entities, always in this order: the owner, the group, and others. So rwxr-x--- means owner rwx, group r-x, others nothing. (On a directory, x lets you enter it and reach the files inside, and r lets you list what's in it.)

ls -l shows a file's permissions, like -rw-r----- 1 kpark science 2048 Mar 2 10:15 grades.csv. The first character is - for a file or d for a directory, then the nine permission characters, then the owner (kpark) and group (science). A + after the permissions means extra permissions are set; view them with getfacl.

chmod changes permissions. Numeric method: one digit per entity (owner, group, others), adding read 4, write 2 and execute 1. chmod 750 report gives rwx (4+2+1), r-x (4+1) and nothing (0). Symbolic method: who (u owner, g group, o others, a all), then + to add or - (a hyphen) to remove, then r, w or x. chmod g+w report adds write for the group; chmod ug+rx report adds read and execute for owner and group; chmod o-r report removes read from others.