Access Control
Access control is the process of regulating who can access what resources in an information system. It
ensures that only authorized individuals can perform actions or gain access to data, systems, or physical
locations. Access control is a key pillar of security that combines authentication, authorization, and
auditing (AAA).
1. Authentication, Authorization, and Auditing (AAA)
1. Authentication
o Definition: Verifying the identity of a user, device, or system before granting access.
o Factors of Authentication:
▪ Something you know (passwords, PINs).
▪ Something you have (smart card, token).
▪ Something you are (biometrics like fingerprint, iris scan).
o Methods:
▪ Single-factor authentication (SFA).
▪ Multi-factor authentication (MFA).
▪ Single sign-on (SSO).
2. Authorization
o Definition: Granting permission to access resources after authentication.
o Determines what an authenticated user can do.
o Examples:
▪ Role-Based Access Control (RBAC): Permissions are based on user roles.
▪ Attribute-Based Access Control (ABAC): Based on attributes like department,
time, location.
▪ Mandatory Access Control (MAC): Central authority defines rules (used in
military).
▪ Discretionary Access Control (DAC): Resource owner decides who can access.
3. Auditing
o Definition: Monitoring and recording activities for accountability.
o Functions:
▪ Logins, failed attempts, file access, administrative actions.
▪ Detecting suspicious activity (e.g., multiple failed logins).
▪ Providing evidence in forensic investigations.
2. Physical Access Control
• Definition: Preventing unauthorized individuals from physically accessing sensitive areas such as
server rooms, data centers, and offices.
• Methods:
o Security guards and reception check-ins.
o Access cards or biometric locks for restricted areas.
o CCTV surveillance for monitoring.
o Physical barriers: fences, locked doors, turnstiles.
• Importance: Even with strong cyber defenses, a physical breach can allow attackers to steal
devices, install malware, or access sensitive records.
3. Passwords
• Definition: The most common authentication method based on "something you know".
• Challenges:
o Weak or reused passwords are easily guessed or cracked.
o Password fatigue due to multiple accounts.
o Vulnerable to phishing, brute-force, and keylogging attacks.
• Best Practices:
o Strong passwords (mix of upper/lower case, numbers, special characters).
o Avoid dictionary words.
o Use password managers.
o Regular password changes.
o Multi-factor authentication (MFA) for higher security.
4. Access Cards and Tokens
• Access Cards
o Smart cards, magnetic stripe cards, or proximity cards.
o Often used in corporate environments for entry to buildings and workstations.
o Can store digital certificates for secure authentication.
• Tokens
o Hardware or software devices generating one-time passwords (OTP).
o Types:
▪ Time-based OTP (TOTP): Code changes every 30–60 seconds.
▪ Event-based OTP (HOTP): Code changes when user requests it.
o Examples: RSA SecurID, Google Authenticator, YubiKey.
o Strong defense against phishing and replay attacks.
5. Biometric Authentication
• Definition: Authentication based on unique physical or behavioral traits of individuals.
• Types of Biometrics:
o Physical: Fingerprint, iris, retina, facial recognition, hand geometry.
o Behavioral: Voice recognition, typing rhythm, gait recognition.
• Advantages:
o Difficult to forge or steal compared to passwords.
o Convenient for users (no need to remember).
• Challenges:
o False Acceptance Rate (FAR) – unauthorized users wrongly accepted.
o False Rejection Rate (FRR) – legitimate users wrongly rejected.
o Privacy concerns: biometric data, once compromised, cannot be changed.
o Requires specialized hardware (scanners, cameras).
Summary
• Access control integrates Authentication (who you are), Authorization (what you can do), and
Auditing (what you did).
• It applies both to cybersecurity and physical security.
• Passwords remain common but should be combined with tokens, access cards, and biometrics
for stronger protection.
• Multi-factor authentication (MFA) and continuous monitoring provide robust defense against
unauthorized access.