Reading into information security, I noticed two branches. Access control when communication with external device by using some type of cryptographic authentication and encryption mechanism and things like control flow integrity. My question is why do we need the latter if former is good enough. Are there example of control flow exploits on access control protocol implementation themselves? My focus is mainly on embedded devices.
Add a comment
|
1 Answer
Control flow integrity and buffer over flow protection are measures against exploiting coding bugs in a program. Access control is about controlling who can access some device or application etc.
By assuming that access control would be sufficient you assume that a) access control itself is perfect and never has any bugs and b) access control makes sure that only innocent users will be able to access the remote device/application. You therefore conclude that the remote device/application can have lots of bugs since no hacker will even be able to reach the buggy code in order to exploit it.
Both assumptions are wrong: a) access control can have bugs like other software and b) some hacker might hack into the trusted client and is therefore treated as authorized to access the remote device/application. And the hacker will not be friendly to a buggy application.
answered Feb 13, 2020 at 18:40
-
I see, so it is kind of extra layer of security if access control fails or authenticated agent exceeds their privilege. Commented Feb 13, 2020 at 19:21
-
@RealTimeEngineer91: It is an additional layer in case access control failed or an authorized client turned malicious. It is also an additional layer of protecting the access control itself against bugs in the access control. Commented Feb 13, 2020 at 19:24