1.6 Access Control
How systems decide who can access what
Networking explains how devices communicate. Access control explains who is allowed to use systems, files, apps, and data once that communication reaches a resource. This is where identity, permissions, MFA, and audit trails start to connect.
What is Access Control?
Access Control is a security technique that regulates who or what can view or use resources in a computing environment. It's a fundamental concept of security compliance that determines who is allowed to access what.
Core Purpose: Access control ensures that only authorized users, processes, or systems can access resources (data, systems, applications) while preventing unauthorized access.
The CIA Triad Connection
Access Control directly supports all three pillars of the CIA Triad:
- Confidentiality: Prevents unauthorized disclosure of information
- Integrity: Prevents unauthorized modification of data
- Availability: Ensures authorized users have access when needed
Key Terms & Keywords
| Term | Definition |
|---|---|
| Subject | The entity (user, process, or system) requesting access to a resource |
| Object | The resource being accessed (file, database, system, application) |
| Access | The ability of a subject to interact with an object |
| Authorization | The process of granting or denying specific requests for access |
| Authentication | Verifying the identity of a subject (proving who you are) |
| Accountability | Tracking and logging user actions (audit trails) |
| Identification | Claiming an identity (username, email, ID number) |
| AAA | Authentication, Authorization, and Accounting, the three pillars |
Access Control Principles
1. Principle of Least Privilege (PoLP)
Users should be granted the minimum level of access necessary to perform their job functions, and nothing more.
Example: A marketing employee needs read-only access to customer data for reports, but not edit or delete permissions. An HR manager needs access to employee records, but not to the company's financial databases.
2. Separation of Duties (SoD)
Sensitive tasks should be divided among multiple people to prevent fraud and errors. No single person should have complete control over a critical process.
Example: In a financial system, one person submits a payment request, another approves it, and a third executes it. This prevents a single employee from embezzling funds.
3. Need-to-Know
Access to sensitive information is granted only to those who require it to perform their duties.
Example: Only the legal department has access to ongoing lawsuit documents, even though other executives have high clearance levels.
4. Defense in Depth
Multiple layers of security controls protect resources. If one layer fails, others still provide protection.
Example: Firewall, VPN, MFA, application-level authentication, and database-level permissions working together.
Types of Access Control Models
1. Discretionary Access Control (DAC)
Owner decides who can access their resources. This is flexible but potentially less secure.
- Who controls: Resource owner
- Example: Windows file permissions, where you can share your folder with specific users
- Weakness: Users might grant excessive permissions
Real-world: You create a Word document and decide to share it with three colleagues by email. You are using DAC.
2. Mandatory Access Control (MAC)
System-enforced access control based on classification levels. Very rigid and secure.
- Who controls: System/Administrator (centralized)
- Uses labels: Top Secret, Secret, Confidential, Unclassified
- Example: Military and government systems (SELinux)
- Rule: Users with "Secret" clearance cannot access "Top Secret" data
Real-world: A military officer with "Confidential" clearance tries to open a "Top Secret" file. The system automatically denies access regardless of their rank.
3. Role-Based Access Control (RBAC)
Most common in corporate environments. Access is assigned based on job roles, not individual identities.
- Who controls: Administrator assigns roles
- How it works: A user receives a role, and that role carries a defined set of permissions
- Example: "HR Manager" role has access to payroll systems, "Developer" role has access to code repositories
- Advantage: Easy to manage when employees change positions
Real-world: When Sarah moves from Marketing to Sales, the admin removes her "Marketing Analyst" role and assigns the "Sales Representative" role. Her access rights automatically update.
4. Rule-Based Access Control (RuBAC)
Access is granted or denied based on specific rules and conditions set by administrators.
- Example: "Allow access only between 9 AM - 5 PM" or "Deny access from IP addresses outside the US"
- Use case: Firewall rules, network access control
Real-world: A firewall rule can block all incoming traffic on port 23 (Telnet), regardless of who is trying to connect.
5. Attribute-Based Access Control (ABAC)
Access decisions are based on attributes of the user, resource, and environment.
- Attributes include: User location, time of day, device type, data sensitivity
- Example: "Allow access to financial reports only if the user is in the Finance department, accessing from the corporate network, and working during business hours"
- Advantage: Highly flexible and context-aware
Real-world: A cloud application allows employees to access customer data only if they're using a company-issued laptop, connected via VPN, and have completed security training in the past 6 months.
Access Control Implementation Methods
Physical Access Controls
- Badge readers: RFID/NFC cards for building entry
- Biometric scanners: Fingerprint, facial recognition, iris scan
- Security guards: Human verification
- Mantrap/Turnstiles: Prevent tailgating (unauthorized entry behind authorized person)
- Locks and keys: Traditional physical barriers
Logical/Technical Access Controls
- Passwords/PINs: Something you know
- Smart cards/Tokens: Something you have
- Biometrics: Something you are
- Access Control Lists (ACLs): Lists of permissions attached to resources
- Firewalls: Network-level access control
- VPN: Secure remote access
- Encryption: Data protection at rest and in transit
Administrative Access Controls
- Policies and procedures: Written rules
- Security awareness training: Educating users
- Background checks: Pre-employment screening
- User access reviews: Periodic audits of who has access to what
- Separation of duties: Policy enforcement
Access Control Lifecycle
| Phase | Description | Example |
|---|---|---|
| 1. Provisioning | Creating accounts and granting initial access | New employee gets username, email, and role-based permissions |
| 2. Review | Periodic audits to ensure access is still appropriate | Quarterly access reviews: "Does John still need admin rights?" |
| 3. Modification | Updating access when roles change | Employee promoted to manager, granted additional permissions |
| 4. Revocation | Removing access when no longer needed | Employee leaves company, all accounts immediately disabled |
Authentication Factors
Types of Authentication (ISC2 Exam Focus)
| Factor Type | Description | Examples |
|---|---|---|
| Type 1: Something You Know | Knowledge-based | Password, PIN, security question |
| Type 2: Something You Have | Possession-based | Smart card, security token, phone (for OTP) |
| Type 3: Something You Are | Biometric-based | Fingerprint, facial recognition, iris scan, voice |
| Type 4: Somewhere You Are | Location-based | GPS location, IP address geolocation |
| Type 5: Something You Do | Action-based | Typing rhythm, signature dynamics, gait analysis |
Multi-Factor Authentication (MFA)
MFA means using two or more different types of authentication factors. It is important for modern security.
Important Distinction: Password plus security question is not true MFA because both are "something you know." Password plus SMS code is true MFA because it combines something you know with something you have.
Example: Logging into your bank account with a password (Type 1) and an SMS code sent to your phone (Type 2) is two-factor authentication.
Access Control Lists (ACLs)
A list attached to an object that specifies which subjects can access it and what operations they can perform.
ACL Structure:
File: project_report.docx
Owner: Alice (Read, Write, Execute, Delete)
User: Bob (Read, Write)
User: Charlie (Read)
Group: Marketing (Read)
Everyone Else: Deny All
Common Permissions:
- Read (R): View the content
- Write (W): Modify the content
- Execute (X): Run the file (for programs/scripts)
- Delete (D): Remove the file
- Full Control: All permissions including changing permissions
Common Access Control Attacks
| Attack Type | Description | Prevention |
|---|---|---|
| Privilege Escalation | Attacker gains higher privileges than authorized | Regular patching, least privilege, input validation |
| Tailgating/Piggybacking | Unauthorized person follows authorized person through secure door | Mantraps, security awareness, badge-only access |
| Password Attacks | Brute force, dictionary, credential stuffing | MFA, strong password policy, account lockout |
| Social Engineering | Manipulating people to divulge credentials | Security awareness training, verification procedures |
| Session Hijacking | Stealing active session tokens/cookies | Encryption (HTTPS), session timeout, secure cookies |
Best Practices
- Implement Least Privilege: Start with minimal access, add as needed
- Use MFA everywhere: Especially for administrative accounts
- Regular Access Reviews: Quarterly audits of user permissions
- Automate provisioning/de-provisioning: Integrate with HR systems
- Log and monitor: Track all access attempts (successful and failed)
- Use RBAC: Easier to manage than individual permissions
- Enforce strong authentication: Minimum password length, complexity, rotation
- Disable inactive accounts: After 30-60 days of inactivity
- Immediate revocation: Disable accounts immediately upon termination
- Network segmentation: Limit lateral movement if breach occurs
ISC2 Exam Tips & Focus Areas
Key Concepts to Memorize:
- Know the difference between authentication (who you are) vs authorization (what you can do)
- Understand the three access control models: DAC, MAC, RBAC
- Be able to identify the five authentication factors
- Understand Principle of Least Privilege and Separation of Duties
- Know what constitutes true MFA (different factor types)
- Understand the difference between Subject (requester) and Object (resource)
Common Exam Questions Format:
- "Which access control model allows the resource owner to determine access?" Answer: DAC
- "An organization assigns permissions based on job functions. Which model is this?" Answer: RBAC
- "Password and security question together provide MFA?" Answer: False because both are Type 1 factors
- "What principle ensures users have only the access they need?" Answer: Least Privilege
- "What prevents one person from completing a critical transaction alone?" Answer: Separation of Duties
Quick Comparison Table
| Model | Control | Flexibility | Security Level | Best For |
|---|---|---|---|---|
| DAC | Owner | Very High | Low-Medium | Small teams, file sharing |
| MAC | System | Very Low | Very High | Military, classified data |
| RBAC | Administrator | Medium | Medium-High | Enterprises, corporations |
| ABAC | Policy Engine | Very High | High | Cloud, complex environments |
Practice Scenario Questions
Scenario 1: A company uses badge readers at the entrance (physical), requires username/password to log into workstations (logical), and has a written security policy (administrative). What is this an example of?
Answer: Defense in Depth / Layered Security
Scenario 2: An employee can share their Google Drive folder with anyone they choose. What type of access control is this?
Answer: Discretionary Access Control (DAC)
Scenario 3: A system requires your fingerprint and a 6-digit PIN to unlock. Is this MFA?
Answer: Yes. It combines something you are (biometric) with something you know (PIN), so it is true MFA.
Scenario 4: In a banking system, one person can initiate a wire transfer, but a different person must approve it before it's sent. What principle is this?
Answer: Separation of Duties (SoD)
Acronyms & Abbreviations Reference
- AAA: Authentication, Authorization, Accounting
- ACL: Access Control List
- ABAC: Attribute-Based Access Control
- DAC: Discretionary Access Control
- MAC: Mandatory Access Control
- RBAC: Role-Based Access Control
- RuBAC: Rule-Based Access Control
- MFA: Multi-Factor Authentication
- 2FA: Two-Factor Authentication
- PoLP: Principle of Least Privilege
- SoD: Separation of Duties
- SSO: Single Sign-On
- PAM: Privileged Access Management
- IAM: Identity and Access Management
Study Checklist
Before your ISC2 CC exam, make sure you can:
- Define access control and explain its purpose
- Explain the AAA framework (Authentication, Authorization, Accounting)
- Differentiate between Subject and Object
- Describe and compare DAC, MAC, RBAC, and ABAC
- List and explain the five authentication factor types
- Explain what constitutes true MFA
- Define Principle of Least Privilege
- Define Separation of Duties
- Explain the access control lifecycle phases
- Identify physical vs logical vs administrative controls
- Recognize common access control attacks
Notes prepared for ISC2 Certified in Cybersecurity | Access Control Fundamentals
Review the terms, then test them with the scenarios above.