Access Control Lab Part 1

Deliverable 1: Enter and see if you get their page.

Deliverable 2: Attempt to connect to a neighbor’s website page again. This time, the port 80 rule should block it.

Deliverable 3: Show the instructor that this worked. Take a snip of the result when Neighbor 1 edits (or attempts to edit) the file. Take a snip of the result when Neighbor 2 edits (or attempts to edit) the file.

Deliverable 4: Answer the following questions based on your experience in this lab: Why is it important to have multiple layers of access instead of relying on just one? Give a specific example from the lab.

It is important to have multiple layers of access instead of relying on just one because if you only have one layer of access controls, once attackers get past that they bypass the access control put in place. An example of this from the lab is

When you blocked your neighbor's web access with the firewall, it was very secure… but they couldn't access your website at all. In a real business, you need to balance security with legitimate access. Describe one scenario where you might need to allow access through a firewall while still maintaining security.

A scenario where you might need to allow access through a firewall while still maintaining security is when you are accessing company data stored on your company's servers from a different network.

Imagine you accidentally gave a user "Full Control" permissions instead of "Read Only" on a folder containing sensitive company financial data. What could go wrong? What would be the potential consequences?

Some things that could go wrong are that the data gets altered, damaged, or accessed by unauthorized people. You created user accounts with "simple passwords for sharing purposes" in this lab. Why would this be a terrible idea in a real production environment? What should you do instead?

In a real production environment, this is terrible because it makes these accounts susceptible to brute force attacks and allows unauthorized individuals access to systems.

Think about a website or online service you use regularly. Identify at least TWO types of access control that service probably uses to protect your data. Be specific.

An online service that I use regularly is the Riot Games client, two types of access controls they use is usernames and passwords as a form of authentication for your account. They use this to make sure you can't log into other peoples accounts and access their information. They also use MFA using phone numbers, emails, and the Riot Mobile authenticator app.