- [Instructor] As we wrap up our discussion
of authorization concepts, let's talk about
a few advanced issues related to authorization
in an access control system.
We need to discuss the implicit deny principle,
rule-based authorization, role-based authorization,
and time of day restrictions.
The implicit deny principle, otherwise known
as default deny, is one of the foundational
principles of access control systems.
It says that anything that is not explicitly allowed
should be denied.
If a computer system doesn't have explicit
instructions on how to handle a situation,
it should default to denying access.
Firewalls are a common example
of the default deny principle in action.
When a firewall receives a connection request,
it first consults its rules to determine
whether a rule explicitly addresses the situation.
If the firewall finds a matching rule,
it carries out the action specified by that rule.
If the firewall does not have explicit guidance
on handling requests, it blocks the connection.
The default deny principle is a very important
security concept, especially when it relates
to firewall configurations.
You should be very familiar with this concept
when taking the Security Plus exam.
Role-based access control systems simplify
some of the work of managing authorizations.
Instead of trying to manage all of the permissions
assigned to each individual user,
administrators create job-based roles
and then assign permissions to those roles.
They can then assign users to roles based upon
the user's job.
This is a little more work up front,
but it makes life much easier down the road.
When a user arrives, the administrator doesn't need
to figure out all of the explicit permissions
that user requires.
The administrator simply assigns the user
to appropriate roles and all of the permissions follow.
Similarly, when a group of users need
a new permission, the administrator doesn't need
to apply that permission to every individual user.
The administrator can simply assign the permission
to the role and all users with that role will receive
the permission automatically.
Let's look at an example.
Imagine that Alice Jones comes to our company
as a new supervisor in the accounting department.
As part of her job, she needs to handle
all the work of an accounting clerk.
Administrators can go ahead and assign her
the accounting clerk role and she will
automatically receive all related permissions.
She will inherit changes as the permissions assigned
to that role change.
Alice also needs advanced privileges reserved
for accounting supervisors.
So administrators can assign her to that role as well.
With two role assignments, in this example,
Alice received six permissions.
And her permissions will change with those roles
as business needs change.
As we wrap up our discussion of authorization concepts,
let's talk about a few advanced issues related
to authorization in an access control system.
We need to discuss the implicit deny principle,
rule-based authorization, role-based authorization,
and time of day restrictions.
From server manager, we click on Tools
and select the Active Directory users
and computers tool.
In the users folder, we right click
on Alice's user entry, and click properties from the popup.
Let's switch over to the account tab
and click the logon hours button.
We can now use this grid to limit the times of day
and days of the week that Alice can logon to the system.
The time shaded blue in the grid are those
where she can access the system.
As you can see, by default, Alice is always
allowed to log in.
Let's remove her ability to access
the system on Sunday by clicking Sunday
and then selecting the Logon Deny permission.
We put that same restriction on Saturday
and then we can also highlight all the early morning hours
before Alice is supposed to get to work.
Click Logon Deny there to remove them from the grid
and then repeat this process for hours
after the end of the normal workday.
And once we go ahead and click okay,
Alice's logon hours are restricted to week days
during business hours.
And that's all there is to implementing
time of day restrictions on a Windows
Active Directory user account.