Access Control

ACCESS CONTROL
What is access control?
Access control is a fundamental component of data security that dictates who’s

allowed to access and use company information and resources. Through
authentication and authorization, access control policies make sure users are who
they say they are and that they have appropriate access to company data. Access
control can also be applied to limit physical access to campuses, buildings, rooms,
and datacenters
There are two categories of access control: physical and logical. Physical access
control limits access to campuses, buildings, rooms and physical IT assets. Logical
access control limits connections to computer networks, system files and data.
To secure a facility, organizations use electronic access control systems that rely
on user credentials, access card readers, auditing and reports to track employee
access to restricted business locations and proprietary areas, such as data centers.
Some of these systems incorporate access control panels to restrict entry to rooms
and buildings, as well as alarms and lockdown capabilities, to prevent unauthorized
access or operations.
Logical access control systems perform

identification authentication and authorization of users and entities by evaluating
required login credentials that can include passwords, personal identification
numbers, biometric scans, security tokens or other authentication factors.
Multifactor authentication (MFA), which requires two or more authentication
factors, is often an important part of a layered defense to protect access control
systems.
TYPES OF ACCESS CONTROL
There are four main types of access control. Organizations typically choose the
method that makes the most sense based on their unique security and compliance
requirements. The four access control models are:
1. Discretionary access control (DAC): In this method, the owner or administrator

of the protected system, data, or resource sets the policies for who is allowed
access.
2. Mandatory access control (MAC): In this nondiscretionary model, people are
granted access based on an information clearance. A central authority regulates
access rights based on different security levels. This model is common in
government and military environments.
3. Role-based access control (RBAC): RBAC grants access based on defined
business functions rather than the individual user’s identity. The goal is to provide
users with access only to data that’s been deemed necessary for their roles within
the organization. This widely used method is based on a complex combination of
role assignments, authorizations, and permissions.
4. Attribute-based access control (ABAC): In this dynamic method, access is based
on a set of attributes and environmental conditions, such as time of day and
location, assigned to both users and resources.
HOW ACCESS CONTROL WORKS

Access control identifies users by verifying various login credentials, which can
include usernames and passwords, PINs, biometric scans, and security tokens.
Many access control systems also include multifactor authentication (MFA), a
method that requires multiple authentication methods to verify a user’s identity.
Once a user is authenticated, access control then authorizes the appropriate level of
access and allowed actions associated with that user’s credentials and IP address.
WHY IS ACCESS CONTROL IMPORTANT?
Access control keeps confidential information such as customer data, personally

identifiable information, and intellectual property from falling into the wrong
hands. It’s a key component of the modern zero trust security framework, which
uses various mechanisms to continuously verify access to the company network.
Without robust access control policies, organizations risk data leakage from both
internal and external sources.
Access control is particularly important for organizations with hybrid
cloud and multi-cloud cloud environments, where resources, apps, and data reside
both on premises and in the cloud. Access control can provide these environments
with more robust access security beyond single sign-on (SSO), and prevent
unauthorized access from unmanaged and BYO devices.
CHALLENGES OF ACCESS CONTROL
Access control systems regulate who or what can access information and resources
and what they can do with these assets. Enterprises typically face these access
control issues:
1. Distributed IT systems
IT systems nowadays often consist of multiple cloud and on-premise networks.

These systems can be geographically scattered and include numerous devices,
assets and virtual machines. Access is granted to all these devices, and keeping
track of them can be difficult.
2. Policy management
Decision-makers within the organization write policies and the IT department

translates the intended policies into code for implementation. Coordination
between these two groups is essential to keep the access control system up-to-date
and working as intended. Policy implementers often lack an understanding of the
intent behind access control rules, and decision-makers usually can’t update or
change policies on their own.
3. Excessive permissions and exceptions
In a competitive market, companies value the agility and flexibility that cloud
workloads offer. Security is often overlooked in a rush to reach a fast time-to-
market. Administrators may grant unnecessary permissions to individual users to
prevent any delays in development. This practice significantly lowers the level of
security provided by the access control system.
4. Monitoring and reporting
Organizations must continuously monitor access control systems to ensure

compliance with internal policies and government regulations. Any violations or
changes should be identified and reported immediately. Failure to do so could
result in confidential information falling into the wrong hands, leading to fines
under privacy laws.
5. Access control models
Access control methods offer various degrees of granularity. Choosing the

appropriate access control model for your organization lets you walk the thin line
between adequate security and employee productivity.
RBAC remains the most widely implemented authorization solution. RBAC is easy
to set up and is more suitable for small businesses and firms. Other legacy
authorization systems include mandatory access control (MAC) and discretionary
access control (DAC). These models are often used by military and government
agencies.

Access Control

Uploaded by

Copyright:

Available Formats

Access Control

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Access Control

Uploaded by

Copyright:

Available Formats

ACCESS CONTROL

What is access control?

Access control is a fundamental component of data security that dictates who’s

Logical access control systems perform

1. Discretionary access control (DAC): In this method, the owner or administrator

HOW ACCESS CONTROL WORKS

WHY IS ACCESS CONTROL IMPORTANT?

Access control keeps confidential information such as customer data, personally

IT systems nowadays often consist of multiple cloud and on-premise networks.

Decision-makers within the organization write policies and the IT department

3. Excessive permissions and exceptions

4. Monitoring and reporting

Organizations must continuously monitor access control systems to ensure

Access control methods offer various degrees of granularity. Choosing the

You might also like