Which Of The Following Describes An Access Control List (Acl)?

What is an access control list (ACL)?

An access control list (ACL) is a list of rules that specifies which users or systems are granted or denied access to a particular object or system resource. Access control lists are also installed in routers or switches, where they act as filters, managing which traffic tin access the network.

Each system resource has a security attribute that identifies its admission command listing. The listing includes an entry for every user who can admission the arrangement. The nigh common privileges for a file system ACL include the ability to read a file or all the files in a directory, to write to the file or files, and to execute the file if it is an executable file or plan. ACLs are as well built into network interfaces and operating systems (OSes), including Linux and Windows. On a computer network, access control lists are used to prohibit or allow certain types of traffic to the network. They commonly filter traffic based on its source and destination.

What are access control lists used for?

Access control lists are used for controlling permissions to a computer arrangement or figurer network. They are used to filter traffic in and out of a specific device. Those devices can be network devices that act equally network gateways or endpoint devices that users admission directly.

On a computer organization, certain users take different levels of privilege, depending on their office. For instance, a user logged in as network ambassador may accept read, write and edit permissions for a sensitive file or other resource. Past contrast, a user logged in as a guest may only accept read permissions.

Access control lists can assist organize traffic to ameliorate network efficiency and to requite network administrators granular control over users on their computer systems and networks. ACLs can also be used to improve network security past keeping out malicious traffic.

How do ACLs piece of work?

Each ACL has 1 or more admission command entries (ACEs) consisting of the name of a user or group of users. The user can too exist a part name, such as programmer or tester. For each of these users, groups or roles, the access privileges are stated in a cord of bits called an access mask. Generally, the system administrator or the object owner creates the admission command list for an object.

Types of admission control lists

There are 2 bones types of ACLs:

File organisation ACLs manage admission to files and directories. They give OSes the instructions that constitute user access permissions for the organization and their privileges once the system has been accessed.
Networking ACLs manage network access by providing instructions to network switches and routers that specify the types of traffic that are allowed to interface with the network. These ACLs likewise specify user permissions once inside the network. The network administrator predefines the networking ACL rules. In this way, they office like to a firewall.

ACLs can besides be categorized by the way they identify traffic:

Standard ACLs block or let an entire protocol suite using source IP addresses.
Extended ACLs block or allow network traffic based on a more differentiated set up of characteristics that includes source and destination IP addresses and port numbers, as opposed to just source address.

Benefits of using an ACL

In that location are several benefits of using an ACL, including the following:

Simplified user identification. An admission control listing simplifies the way that users are identified. ACLs ensure that merely canonical users and traffic have access to a system.
Performance. ACLs provide functioning advantages over other technologies that perform the same function. They are configured straight on the routing device'southward forwarding hardware, and so admission command lists do not have a negative performance outcome on routing devices. Compare this to a stateful inspection firewall, which is a divide piece of software that may crusade performance deposition. Also, controlling network traffic enables networks to be more efficient.
Control. ACLs can give administrators more granular control over user and traffic permissions on a network at many different points in the network. They help control admission to network endpoints and traffic flowing betwixt internal networks.

Where tin you place an admission control list?

Access control lists tin be placed on well-nigh any security or routing device, and having multiple ACLs in dissimilar parts of the network can be beneficial.

ACLs are well suited to network endpoints -- like applications or servers -- that require high speed and performance, as well every bit security.

Network administrators may cull to identify an access control listing at unlike points in the network depending on the network architecture. ACLs are often placed on the edge routers of a network considering they border the public internet. This gives the ACL a chance to filter traffic before it reaches the rest of the network.

Edge routers with ACLs tin be placed in the demilitarized zone (DMZ) between the public internet and the balance of the network. A DMZ is a buffer zone with an outward-facing router that provides full general security from all external networks. It also features an internal router that separates the DMZ from the protected network.

DMZs may incorporate different network resource, like awarding servers, spider web servers, domain name servers or virtual private networks. The configuration of the ACL on the routing device is different, depending on the devices behind it and the categories of user that need access to those devices.

DMZ architecture graphic — ACLs are normally placed in the DMZ or on the perimeter to filter traffic.

Components of an access command listing

ACL entries consist of several dissimilar components that specify how the ACL treats different traffic types. Some examples of common ACL components include the following:

Sequence number. The sequence number shows the identity of the object in the ACL entry.
ACL proper name. This identifies an ACL using a name instead of a number. Some ACLs let both numbers and letters.
Comments. Some ACLs enable users to add together comments, which are actress descriptions of the ACL entry.
Network protocol. This enables admins to allow or deny traffic based on a network protocol, such every bit IP, Internet Control Message Protocol, TCP, User Datagram Protocol or NetBIOS, for case.
Source and destination. This defines a specific IP address to block or permit or an accost range based on Classless Inter-Domain Routing.
Log. Some ACL devices keep a log of objects that the ACL recognizes.

More than advanced ACL entries can specify traffic based on certain IP packet header fields, like Differentiated Services Code Point, Type of Service or IP precedence.

How to implement an ACL

To implement an ACL, network administrators must sympathize the types of traffic that menstruation in and out of the network, likewise as the types of resource they are trying to protect. Administrators should hierarchically organize and manage IT avails in separate categories and administer dissimilar privileges to users.

network security diagram — Maintaining access command is a primal component of network security.

A standard ACL list is mostly implemented close to the destination that it is trying to protect. Extended access control lists are more often than not implemented close to the source. Extended ACLs can be configured using access list names instead of access listing numbers.

The basic syntax used to create a standard numbered access control list on a Cisco router is as follows:

            Router (config)# access-list (1300-1999) (permit | deny) source-addr (source-wildcard)

The various parts hateful the post-obit:

(1300-1999) specifies the ACL IP number range. This names the ACL and defines the blazon of ACL. 1300-1999 makes this a standard ACL.
(permit | deny) specifies the package to permit or pass up.
Source-addr specifies the source IP address.
Source-wildcard specifies the wildcard mask.

A wildcard mask tells a router which bits of an IP address are available for a network device to examine and determine if it matches the access list.

Users tin can enter the in a higher place configuration code into the control line to create the access control list. Cloud platforms from vendors, including Oracle and IBM, also typically offer an option to create an access control listing in their user login portal.

Setting user permissions throughout a calculator system can be boring, but at that place are ways to automate the script .

Access command lists must be configured differently based on differences in network architecture. This includes differences betwixt on-premises, physical networks and cloud networks. Learn the basics of cloud network architecture and network management.