What Is Access Control?
Access control is an IT security concept for controlling who can interact with resources and systems within a computing environment. It involves managing permissions and privileges so that only authorized users and applications can access specific resources. The main goal of access control is to minimize business risks.
Types Of Access Control
There are two types of access control:
Physical Access Control
Physical access control restricts entry to spaces, buildings, rooms, and physical access to devices such as routers, switches, etc. Physical access control systems typically involve door locks, reception, security guards, security cameras, and alarms to prevent unauthorized access.
Logical Access Control
Logical access controls restrict connections to networks, applications, systems, files, and data. Traditionally, logical access controls relied only on login credentials, i.e. username-password combinations to prevent unauthorized access. But recently, Multifactor authentication (MFA), which requires two or more authentication factors, is being used for added security. MFA authentication factors typically include login credentials, biometric scans, security tokens, etc.
How Does Access Control Work?
Access control works by identifying individual users or applications and verifying that they are who they claim to be. After that, it authorizes the verified user or application to access the resource and perform actions that are associated with the username, device, or IP address. It utilizes shared information infrastructure such as directory services and protocols for authenticating and authorizing users and for allowing access to resources.
Key Concepts Of Access Control
Access control is built around two main concepts- authentication and authorization.
Authentication
Authentication is a method of separating legitimate users from unsanctioned ones. It involves verifying the identity of a user, device, or application before granting access. Common methods of authentication include Password authentication, Two-Factor Authentication (2FA), Biometric authentication, and Single Sign-On (SSO).
Authorization
Authorization is a method of ensuring that the actions an authenticated identity makes are permitted. Typically each identity has permissions or privileges associated with it so that it is known what resources it can access and what actions it can perform on those resources. The authorization process is used to verify the permissions or privileges of an identity before granting access.
Access Control Models
The following are the most commonly used access control models:
1. Discretionary Access Control (DAC)
Discretionary Access Control (DAC) is an access control model used to govern access to resources based on the discretion of the resource owner, who has complete control over who can access their resources and the level of access they have. It is discretionary because it allows the resource owners to make access decisions based on their personal judgment and preferences.
In DAC, the access control is decentralized, i.e. every resource such as files, folders, and objects has an associated owner, who is either the entity that created the resource or was granted ownership. The DAC model uses Access Control Lists (ACLs), which specify the access rights of users or groups and are managed by the resource owner. The access rights typically include actions such as read, write, and delete.
DAC is also flexible as it allows granular control over access permissions, making it suitable for situations where resource owners have specific, dynamic access requirements. The resource owners also have complete authority to determine the access rights to their resources and modify access permissions as needed without requiring approval from administrators.
Thanks to clearly defined ownership of resources, DAC helps establish accountability. The resource owners are responsible for access decisions, and if unauthorized access occurs, it can be traced back to the responsible resource owner.
While DAC offers benefits of autonomy, granularity, and flexibility, it also has limitations. The biggest concern with DAC is that it relies on the resource owner's discretion, which often leads to inconsistent or inadequate application of security policies. This makes it unsuitable for highly regulated or security-critical environments requiring stricter access control.
2. Mandatory Access Control (MAC)
Mandatory Access Control (MAC) is an access control model used to enforce strict and centralized access control policies. MAC uses predefined security labels and policies set by system administrators or security administrators to control access permissions.
In MAC, every resource such as files, folders, and objects and subjects such as users or processes are assigned security labels, which define their security classifications. The labels indicate the sensitivity and classification of the resource and the security clearance or authorization level of the subject. Access decisions are made based on the security labels attached to both the resource and the subject. "Secret," "Confidential," and "Unclassified" are examples of commonly used security classifications.
In MAC, the access control is centralized. The access control system enforces strict adherence to security policies and resource owners have no authority to change or override access permissions. MAC is typically hierarchical, i.e. users with higher-security classifications can access resources with lower-security, but not vice versa.
MAC provides strong security against unauthorized access and information leakage. Additionally, It is also closely aligned with the principle of least privilege (PoLP), ensuring that users are given only the minimum access necessary to perform their duties, based on their security classification and the sensitivity of the resources they need to access. Therefore, MAC is well-suited for organizations with high-security needs and strict data confidentiality requirements.
3. Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC) is an access control model used to manage and enforce access rights and permissions within an organization's IT systems. RBAC simplifies access control management by grouping users into roles and assigning permissions to those roles. This method is much easier compared to managing permissions individually for each user.
In RBAC, each role represents a set of responsibilities, job functions, or job titles within an organization. These roles are given predefined privileges based on the job functions they perform. For example, roles like “Consultant”, “Sales Executive”, and “Systems Administrator” are quite commonly used. When a user is assigned a role, they automatically inherit the permissions associated with that role. Users can also be assigned more than one role depending on their job function and specific requirements.
In RBAC, permissions are associated with roles, not individual users. This makes it easy to manage access control and prevents privilege creep. Permissions are dynamically assigned and revoked as a user's job function changes, ensuring that users have the appropriate level of access based on their current roles. So, RBAC also aligns with the principle of least privilege.
In this model, the definition and management of roles and associated permissions is done centrally, typically by system administrators. This makes it easier to consistently apply policies, enhancing security and simplifying administration. The central management also facilitates auditing and monitoring of user-role assignments and permissions, which aids in compliance audits and security assessments.
Given these characteristics, RBAC is well-suited for organizations of all sizes. And as the organization grows, RBAC can effectively manage the growing access control requirements without compromising security or adding undue complexity.
4. Attribute-Based Access Control (ABAC)
Attribute-Based Access Control (ABAC) is an access control model that makes access control decisions based on the attributes associated with users, resources, and environmental conditions. Unlike traditional access control models, ABAC is a more fine-grained and dynamic method of managing access to resources since it considers a range of attributes beyond just roles and permissions.
In ABAC, attributes are characteristics or properties associated with users, resources, and environmental conditions. Typically, attributes include user roles, user attributes (such as department, and security clearance), resource attributes (such as data classification, and location), and environmental attributes (such as time of day, and network location).
ABAC uses access control policies that define the rules for granting or denying access based on attributes and conditions. Although these policies are often complex, they are flexible and allow dynamic access control decisions.
ABAC systems evaluate attribute values and make access decisions in real-time. This means that access control decisions take into account the current state of attributes and conditions, which allows for more dynamic and context-aware access control. For example, access to a sensitive document may be granted to a user only if they have a certain security clearance, and are on the corporate network during business hours.
ABAC is a scalable access control solution that can handle complex access control scenarios in large and diverse organizations. It is well-suited for organizations that require dynamic and granular access control at scale, something that traditional models are not able to provide.
Components Of Access Control
1. Authentication and Authorization Protocols
Authentication and authorization protocols are types of communications protocols specifically designed for the transfer of authentication data between two entities. Authentication protocols contain specific rules and procedures that all entities must agree to use before communicating. It allows the receiving entity to authenticate the connecting entity and vice versa.
These protocols serve as a critical security layer that protects communication within computer networks. OAuth, LDAP, and Kerberos are common examples of protocols that facilitate secure authentication and authorization within an IT environment.
2. Access Control Lists (ACLs)
Access Control Lists (ACLs) are a type of security control for protecting the network resources and digital assets of an organization. ACLs contain rules for allowing or denying access to resources such as networks or files. Typically the access permissions are associated with objects (such as files, folders, or network resources) and specify who can access them and what actions (such as read, write, or delete) they can perform.
3. Access Control Policies
Access control policies are documents that define rules and conditions for granting, managing, and revoking access rights. These policies serve as a guide for system administrators and aid in the consistent application of policies and ensuring that security requirements are met.
4. Access Logging and Monitoring
Access logging and monitoring systems are mechanisms that record access control events and access attempts, including successful and unsuccessful ones. These logs help organizations track who accessed what resources and when and play a vital role in auditing, compliance, and security incident investigations.
Conclusion
Modern business IT environments are complex ecosystems with a variety of devices, applications, systems, and users with varying access requirements. Ensuring the security of this complex system requires various components that work together to create a layered and comprehensive access control system, protecting the organization's assets and data from unauthorized access and potential security threats.
Access control is a critical part of modern IT environments that is responsible for ensuring that only authorized individuals or entities can gain access to company resources while preventing unauthorized access and potential security breaches.
Does your organization have an effective access control system in place? Do you need to upgrade your access control to improve accessibility and enhance security? Reach out to us by clicking the button below and learn how we can help you with your access control and security.
If you liked the blog, please share it with your friends
About The Author
Hari SubediMarketing Manager at Jones IT
Hari is an online marketing professional with a focus on content marketing. He writes on topics related to IT, Security, and Small Business. He is also the founder and managing director of Girivar Kft., a business services company located in Budapest, Hungary.