What is Access Control List | ACL Types & Linux vs Windows | Imperva

What is an

access control list An access

control list (ACL) contains rules that grant or deny access to certain digital environments. There are two types

of ACLs:

• File system ACLs: Filter access to files and/or directories. File system ACLs tell operating systems which users can access the system and what privileges they are allowed.
• Network ACLs: Filters network access. Network ACLs tell routers and switches what type of traffic can access the network and what activity is allowed.

Originally, ACLs were the only way to achieve firewall protection. Today, there are many types of firewalls and alternatives to ACLs. However, organizations continue to use ACLs along with technologies such as virtual private networks (VPNs) that specify what traffic must be encrypted and transferred through a VPN tunnel.

Reasons to use an ACL:

• Traffic flow control

Restricted network traffic for

• better network performance A
• security level for network access that specifies which areas of the server/network/service a user can and cannot access
• . Granular monitoring of traffic going to and from

the system

Blog: Determining “Need to Share vs. Need to Know” is a cornerstone of a data protection strategy

. How ACL

works

A file system ACL is a table that informs a computer’s operating system of the access privileges a user has to a system object. including a single file or a directory of files. Each object has a security property that connects it to its access control list. The list has an entry for each user with access rights to the system.

Typical privileges include the right to read a single file (or all files) in a directory, execute the file, or write to the file or files. Operating systems that use an ACL include, for example, Microsoft Windows NT/2000, Novell Netware, Digital OpenVMS, and UNIX-based systems.

When a user requests an object in an ACL-based security model, the operating system scans the ACL for relevant input and checks whether the requested operation is permissible.

Network ACLs are installed on routers or switches, where they act as traffic filters. Each network ACL contains predefined rules that control which routing packets or updates are allowed or denied access to a network.

ACL routers and switches function as packet filters that transfer or deny packets based on filtering criteria. As a layer 3 device, a packet filtering router uses rules to see whether to allow or deny access to traffic. It decides this based on the source and destination IP addresses, destination port and source port, and the official procedure of the packet.

Types

of Access Control Lists Access control lists

can be addressed in relation to two main categories:

Standard ACLs An access list that is developed solely using the source IP address. These access control lists allow or block the entire set of protocols. They do not differentiate between IP traffic such as UDP, TCP, and HTTPS. They use the numbers 1-99 or 1300-1999 so that the router can recognize the address as the source IP address.

Extended ACL An access list that is widely used because it can differentiate IP traffic. It uses source and destination IP addresses and port numbers to make sense of IP traffic. You can also specify which IP traffic should be allowed or denied. They use the numbers 100-199 and 2000-2699.

Linux ACL

vs. ACL

Windows

Linux provides the flexibility to make modifications to the kernel, which you can’t do with Windows. However, because you can make kernel modifications on Linux, you may need specialized expertise to maintain the production environment.

Windows offers the advantage of a stable platform, but it is not as flexible as Linux. In relation to application integration, Windows is easier than Linux.

A user can set access control mechanisms in a Windows box without adding software.

In terms of patches, Microsoft is the only source that issues Windows patches. With Linux, you can choose to wait until a commercial Linux vendor releases a patch or you can opt for an open source entity for patches.

ACL Best

Practices

When configuring ACLs, you should follow some best practices to ensure that security is tight and suspicious traffic is blocked:

1. ACLs everywhere ACLs are applied on every interface, on almost every security or routing computer. This is appropriate as you may not have the same rules for outward-facing interfaces and interfaces that form your campus network. However, the interfaces are similar and you don’t want some to be protected by ACLs and others exposed.

Practicing an ACL on all interfaces is essential for incoming ACLs, specifically the rules that decide which address can transfer data to your network. Those are the rules that make a considerable difference.

2. ACLs in

order In almost all cases, the engine that applies the ACL starts at the top and moves down the list. This has implications for determining what an ACL will do with a specific data stream.

One of the reasons organizations adopt ACLs is that they have less computational overhead than stateful firewalls and operate at high speeds. This is essential when you are trying to implement security for fast network interfaces. However, the longer a packet remains on the system, while it is examined against ACL rules, the slower the performance.

The trick is to put the rules you expect to trigger at the top of the ACL. Work from the general to the specific, while ensuring that rules are logically grouped. You should know that each packet will be acted upon by the initial rule it triggers, you could end up passing a packet through one rule when you intend to block it through another. Consider how you want the event chain to occur, particularly when adding new rules.

3. Document your work When you add ACL rules, document why you add them, what they intend to do, and when you added them.

It is not necessary to have a comment as a rule. You can make a comment for a rule block, an intricate explanation for a single rule, or a combination of both approaches.

Developers need to make sure that the current rules are documented, so that no one has to guess why there is a rule.

Blog: 6 Data Security Best Practices You Can Start Today.

RBAC vs ACLs Developers

can use role-based access list (RBAC) systems to control security at a granular level. Instead of emphasizing the user’s identity and determining whether they should be allowed to see something in the app, RBAC governs security based on the user’s role within an organization.

For example, instead of giving permission to John Smith, an architect in New York, RBAC would give permission for a role for American architects. John Smith may be one of many users with that role. Therefore, RBAC assures regulators that only specific users have access to sensitive information, as it grants all role-based approvals.

RBAC is generally considered a preferred method for commercial applications. RBAC is more effective than ACL in relation to administrative overhead and security. ACLs are best used to enforce security at the individual user level. You can use RBAC to serve an enterprise-wide security system, which is overseen by an administrator. An ACL can, for example, provide write access to a particular file, but it cannot define how a user can modify the file.

Role-based

access control with Imperva

Imperva enables control of user privileges through flexible role-based access controls. Users are provided with restricted or read-only, editing, role access and management objects. Organizations can also hierarchically group and manage IT assets into categories for fine-grained access control, even in large-scale enterprise and managed security service provider (MSSP) deployments.