Access controls, an essential part of cybersecurity, is the management of who has access to different apps, resources, and, most importantly, data and information stored across an organization’s systems. These security measures can include physical access controls, as well as, technical controls, such as firewalls, intrusion detection systems, and encryption, as well as administrative controls, such as policies, procedures, audits, and user education.
Types of access control?
There are five different types of access controls, each allows access to sensitive information in a unique way.
Discretionary access control (DAC)
- In DAC models, every object in a protected system has an owner, and owners grant access to users at their discretion. DAC provides case-by-case control over resources.
Mandatory access control (MAC)
- In MAC models, users are granted access in the form of a clearance. A central authority regulates access rights and organizes them into tiers, which uniformly expand in scope. This model is very common in government and military contexts.
Role-based access control (RBAC)
- In RBAC models, access rights are granted based on defined business functions, rather than individuals’ identity or seniority. The goal is to provide users only with the data they need to perform their jobs—and no more.
Attribute-based access control (ABAC)
- In ABAC models, access is granted flexibly based on a combination of attributes and environmental conditions, such as time and location. ABAC is the most granular access control model and helps reduce the number of role assignments.
Policy-based access control (PBAC)
- In PBAC models, access control is managed and privilege is granted based on someone’s role and attributes in the organization, combined with policies. PBAC enforces policies on system users, letting these rules determine user access based on the role or attributes of the individual.
Access control policies are critical for ensuring the confidentiality, integrity, and availability of resources and systems, and for preventing unauthorized access by individual users to mitigate any vulnerabilities that may arise. They are an important aspect of any security policies and are closely related to the principle of least privilege and the zero trust security model.
What kind of steps are normally taken to enforce and update access controls?
Access control works by regulating who or what is allowed to access specific resources or systems. The process typically involves the following steps:
- Identification and authentication: The user or device attempting to access a resource is first required to identify themselves, usually by providing a username and password. The system then verifies the authenticity of the identity, typically by checking it against a list of authorized users or devices. Additional forms of authentication such as security tokens, biometric data, or multi-factor authentication (mfa) can also be used.
- Authorization: Once the identity of the user or device has been verified, the system checks to see what resources the user or device is authorized to access. This is typically done by comparing the user or device identity and permissions to an access control list which contains rules or policies pertaining to the access employees are eligible to receive based on user credentials and roles.
- Access granted or denied: If the user or device is authorized to access the resource, they are granted access. If they are not authorized, access is denied and an error message is displayed.
- Accountability: Access attempts are logged and tracked, so that the system can maintain a record of who accessed what resources, and when. This information can be used to detect and investigate any unauthorized access attempts.
- Non-repudiation: The access control system must be able to provide evidence of who or what accessed a particular resource, and when, so that any user or device cannot deny having done so.
Access control systems can be implemented using a variety of technologies, including software and hardware-based solutions, and can range from simple username and password-based systems to more advanced multi-factor authentication systems.
Why are access controls important?
Access controls are important for several reasons, including cybersecurity, compliance, data security, auditing and accountability, business continuity, and enforcement of the principle of least privilege.
Through the implementation of access controls, organizations can prevent unauthorized access to sensitive data and systems to reduce security risks, comply with industry regulations, and maintain confidentiality, integrity, and availability of information. They can also ensure that access to resources and systems are tracked and logged which helps organizations identify and respond to security incidents more quickly and effectively.
How are access controls related to the principle of least privilege?
Access control and least privilege are closely related concepts. Access controls are security measures put in place to regulate who is allowed to access specific resources or systems. Least privilege is a security principle that states that a user or program should have the minimum level of access necessary to perform its intended function.
In practice, access controls are implemented to enforce the principle of least privilege by limiting access to resources based on a user’s identity and their specific job function or role. For example, an employee in the accounting department would only be granted access to the financial data they need to perform their job, and would not be granted access to sensitive HR data. A system administrator would have more access than a regular user, but still would not have access to all the data or systems, just the ones necessary to perform their job.
By implementing access controls that enforce least privilege, organizations can reduce the potential damage caused by a security breach or by a user or system with malicious intent. Additionally, it also helps organizations to meet regulatory compliance requirements and industry standards, as it limits the access to sensitive data, thus reducing the risk of data breaches, and ensuring the confidentiality and integrity of data.
In short, access controls and least privilege are complementary concepts that work together to provide a more secure environment by limiting access to resources to only those who need it, and only to the level necessary.
Summary
Access controls are an integral part of identity and access management (IAM). By implementing these controls and requiring end users to log access requests in order to gain access to customer data and other critical resources, organizations can meet various data, information security and compliance regulations.
There are four main types of access controls and each refers to different aspects of who needs access and who confirms and allows the access. The control and record of access ensures that only the people who need the access to certain information are authorized and need to use it for the purpose of completing their job.
