ACCESS CONTROL

Introduction to Access Control

Access control refers to the processes, mechanisms, and policies that regulate who (users, devices,
processes) is allowed to access or use organizational resources (data, systems, networks).

It ensures that only authorized subjects can interact with protected objects according to
predefined rules.

Objectives of Access Control

Access control directly supports the CIA Triad.

1. Confidentiality
Prevents unauthorized access to sensitive information.

2. Integrity

Ensures data is accessed or modified only by authorized individuals.

3. Availability

Ensures legitimate users have timely access to resources.

Additional Objectives

• Accountability (through logging and auditing)

• Non-repudiation

• Minimizing insider threats

• Enforcing least privilege

Components of an Access Control System

1. Subject

Entity requesting access (user, application, process).

2. Object

Resource being protected (file, system, database, network).

3. Access Control Policies

Rules that determine what type of access is granted.

4. Access Control Mechanisms

Technical or administrative controls used to enforce policies.
5. Access Control Models

Frameworks governing how rights and permissions are structured.

6. Authorization

Determines what actions an authenticated subject can perform.

7. Authentication

Verifies the identity of the subject requesting access.

Types of Access Control

Access control is implemented using several models and mechanisms.

The major types include:

A. Discretionary Access Control (DAC)

A model where resource owners have the authority to grant or deny access to other users.
Characteristics

• Owner-centric

• Flexible and easy to manage

• Often implemented via Access Control Lists (ACLs)

Advantages

• Simple to administer

• Flexible permissions
• Suitable for low to moderate security environments

Disadvantages

• Vulnerable to insider threats

• Users can override controls

• Malware spreading risk is higher

Examples

• Windows NTFS permissions

• UNIX file permissions (rwx)
B. Mandatory Access Control (MAC)

A strict access control model where access is granted based on security labels assigned to subjects
and objects.

Characteristics

• Central authority sets and enforces rules

• Not modifiable by end-users

• Used in high-security environments

Advantages

• Extremely secure
• Prevents unauthorized information flow

• Suitable for government and military

Disadvantages

• Complex to manage

• Limited flexibility
• Expensive to implement

Examples

• SELinux (Security-Enhanced Linux)

• Military classification systems (Top Secret, Secret, Confidential)

C. Role-Based Access Control (RBAC)

Access rights are assigned based on the roles individuals hold within the organization.

Characteristics
• Permissions assigned to roles, not individuals

• Users inherit permissions based on job function

• Supports the principle of least privilege

Advantages

• Easy to manage large user populations

• Reduces administrative overhead
 • Scales well

Disadvantages

• Role explosion if poorly designed

• Requires careful job-role analysis

Examples

• ERP systems (e.g. SAP roles)

• Cloud IAM (AWS IAM roles, Azure RBAC)

D. Rule-Based Access Control (RAC)

Uses global rules to control access, often defined by system administrators.

Characteristics

• Rules can be based on conditions (time, location, behavior)

• Often implemented in firewalls and network devices

Examples

• Firewall rules (e.g. Block port 22 externally)

• Geo-restriction policies

• Time-of-day access restrictions

E. Attribute-Based Access Control (ABAC)

Access is granted based on attributes of the user, resource, environment, or action.

Attributes May Include:

• User attributes (department, clearance level)

• Resource attributes (file sensitivity)

• Environmental attributes (location, time)

Characteristics

• Highly dynamic and context-aware

• Used in modern cloud and zero-trust architectures

Advantages
• Very granular control
 • High flexibility

Disadvantages

• Complex policy creation

• Hard to troubleshoot
Examples

• AWS IAM Identity Policies (JSON-based)

• Google Cloud IAM conditions

• Zero Trust Access systems

F. Identity-Based Access Control (IBAC)

Grants access based on the identity of the user, often using authentication systems.

Characteristics

• Identity is validated using credentials

• Basic form of access control

Examples

• Username & password authentication

• MFA systems

G. Time-Based Access Control (TBAC)

Access is allowed only during specific times or schedules.

Examples
• Access to payroll systems only during work hours

• Database access restricted at night

H. Location-Based Access Control (LBAC)

Access permissions depend on the geographical or network location of the user.

Examples

• Access allowed only from corporate network

• Blocking logins from suspicious countries

I. Physical Access Control
Controls access to buildings or physical environments.

Examples

• Biometric scanners

• RFID key cards

• Smart locks

Often integrated with logical access control in high-security environments.

Access Control Mechanisms

1. Access Control Lists (ACLs)

Define which users can perform what actions on an object.

2. Capabilities / Capability Lists

Tokens that define what resources a user can access.

3. Multi-factor Authentication (MFA)

Strengthens authentication.

4. Encryption

Protects access to data even if stolen.

5. Biometrics

Used for identity verification.

6. Tokens & Certificates

Digital certificates provide cryptographic identity.

Access Control Principles

Least Privilege

Users should receive only the permissions required to perform their tasks.

Separation of Duties

Divide tasks to reduce fraud or errors.

Need-to-Know
Users access information strictly necessary for their role.

Defense-in-Depth

Multiple layers of access restrictions.

Fail-Safe / Fail-Closed
If a system fails, access should default to denial.

Access Control Threats & Vulnerabilities

1. Privilege escalation

2. Broken authentication

3. Insider threats

4. Weak passwords

5. Bypassing access controls

6. Misconfigured IAM systems

7. Credential theft (phishing, keyloggers, malware)

Access Control in Digital Forensics

Access control impacts forensic investigations by:

• Determining who had legal/system access at the time of incident

• Providing audit logs for user behavior

• Revealing misuse of privileges

• Supporting chain-of-custody for evidence handling

• Showing role violations or compromised accounts

Access Control in Modern Cybersecurity

Zero-Trust Architecture (ZTA)

“Never trust, always verify.”

Relies heavily on:

• Strong identity
• Continuous authentication
 • ABAC-style dynamic rules

Cloud IAM (Identity & Access Management)

Cloud providers implement access control via:

• Policies
• Roles

• Permissions

• Conditions

Examples: AWS IAM, Azure AD, Google IAM.