Access Control
Access control is the selective restriction of access to an asset or a system/network resource. It protects information assets by determining who can access what. The mechanism uses user identification, authentication, and authorization together to restrict or grant access to a specific asset/resource.
Behind the scenes, an Administrator manages the Authorization Database that both the Authentication and Access Control functions consult.
Access Control Terminologies
The first arrow into the Reference Monitor is Authentication; the granted request out of it is Authorization.
Mnemonic — SORO
"Subjects Operate on Reference-checked Objects" → Subject wants access, Object is the target, Reference Monitor is the bouncer checking the rules, Operation is the actual action performed. Subject and Object are the "who and what"; Reference Monitor and Operation are the "gatekeeper and the act."
Access Control Principles
Separation of Duties (SoD)
Breaks the authorization process down into multiple steps, assigning different privileges at each step to different subjects. This ensures no single individual has the rights to perform all functions — and simultaneously denies total access to one person.
Need-to-Know
Access is provided only to the information required for performing a specific task — nothing more.
Principle of Least Privilege (POLP)
Extends need-to-know: gives employees exactly the access they need — not more, not less. Protects against malicious behavior and improves system stability and security.
Mnemonic — SNP Ladder
"Split, Need, Precise" → Separation of duties splits one big job into many small ones so no one person is all-powerful. Need-to-know limits information to what's task-relevant. POLP is the strictest — precise, minimal access across the board. Think of them as three tightening circles: split the job → limit the info → minimize the access.
Access Control Models
Access control models are standards that provide a predefined framework for implementing the necessary level of access control.
Only the administrator/system owner has the rights to assign privileges. It does not permit the end user to decide who can access the information. Examples: SELinux, Trusted Solaris.
The end user has complete access to and control over the information they own — they decide who else can access it.
Permissions are assigned based on user roles (e.g. "Manager", "HR", "Intern") rather than to individual users directly.
Permissions are assigned to a user role dynamically based on a set of rules defined by the administrator.
Mnemonic — "My Dad Really Rules"
MAC = admin decides, no exceptions (military-grade). DAC = owner decides (Dad decides his own stuff). RBAC = Role decides (your job title decides access). RB-RBAC = Rules decide dynamically on top of roles. Order of strictness: MAC (most rigid) → RB-RBAC → RBAC → DAC (most flexible).
Logical Implementation of DAC, MAC, RBAC
| Model | Real-World Implementation |
|---|---|
| Logical access control (general) | Access control lists (ACLs), group policies, passwords, account restrictions |
| DAC | Windows File Permissions |
| MAC | User Account Control (UAC) tool in Windows OS |
| RBAC | Just Enough Administration (JEA); Windows Admin Center (WAC) |
Identity and Access Management (IAM)
IAM is responsible for providing the right individual with the right access at the right time. It's organized into two big halves that together cover the whole lifecycle of a user's digital identity.
Involves storing and managing user attributes in repositories. User Identification is a method to ensure an individual holds a valid identity (e.g. username, account number, user roles). Feeds an Identity Repository — a database where user identity attributes are stored.
Covers Authentication (verifying who you are) and Authorization (deciding what you can do), drawing on the Identity Repository built by IDM.
Requesters and approvers submit identity data (via HR systems, CRM, other apps) through IDM into a central Identity Repository, which the AM layer then uses to authenticate and authorize users accessing applications.
User Access Management: Authentication
Authentication involves validating the identity of an individual with a system, application, or network. There are five key types covered in this chapter.
Biometric Identification Techniques
| Technique | How It Works |
|---|---|
| Fingerprint Scanning | Compares two fingerprints for verification/identification based on finger patterns |
| Retinal Scanning | Analyzes the layer of blood vessels at the back of the eye |
| Iris Scanning | Analyzes the colored part of the eye suspended behind the cornea |
| Vein Structure Recognition | Analyzes thickness and location of veins |
| Face Recognition | Uses facial features to identify/verify a person |
| Voice Recognition | Uses voice patterns to identify/verify a person |
Mnemonic — Know, Have, Are
"KHA" → Something you Know (password/PIN), something you Have (smart card/token/phone), something you Are (biometrics). Two-factor authentication mixes any two of these. Remember: "Are" is the hardest to forge or spoof — biometrics are the strongest partner in a 2FA combo.
- No need to remember passwords for multiple applications
- Reduces time spent entering username and password repeatedly
- Reduces network traffic to the centralized authentication server
- Users enter credentials only once for multiple applications (e.g. application server, email server, database server)
User Access Management: Authorization
Authorization involves controlling the access of information for an individual — e.g. a user may only read a file, but not write to or delete it.
Authorization for network access is done via a single centralized unit, maintaining one database for all resources/applications. Easy and inexpensive.
Each network resource maintains its own authorization unit and performs authorization locally, with its own database.
Users can access a requested resource on behalf of others — the access request passes through a primary resource to reach the requested resource.
Unlike implicit, requires separate authorization for each requested resource — it explicitly maintains authorization per object.
Mnemonic — One Desk vs. Many Desks
Centralized = one help-desk handles every request (single DB). Decentralized = every department has its own help-desk (separate DBs). Implicit = you get let in because you're "with someone who's already allowed in." Explicit = you need your own separate pass for every single room.
User Accounting & Accountability
Accounting is a method of keeping track of user actions on the network — it records who, when, and how users access the network. It helps identify authorized vs. unauthorized actions, and the data supports trend analysis, data breach detection, and forensics investigations.
All of this together — Identity, Authentication, Authorization — is monitored and logged as Accountability.
Mnemonic — The AAA Chain (IAAA)
"I Ate All Apples" → Identification (claim who you are) → Authentication (prove it) → Authorization (get permission) → Accounting (get logged). This four-step chain is the single most tested sequence in this chapter — every access event walks through all four stages in order.
Exam Tips & Tricks
IAAA order matters
Identification → Authentication → Authorization → Accounting. Exam questions often give you a scenario and ask which stage is being described.
MAC vs DAC — who decides?
MAC: administrator decides, no exceptions. DAC: the resource owner decides. This is the #1 distinction tested.
Don't mix up RBAC and RB-RBAC
RBAC assigns permissions by role. RB-RBAC dynamically assigns roles/permissions based on admin-defined rules — the "rule" layer sits on top of roles.
Know the SELinux example
SELinux and Trusted Solaris are the textbook examples of MAC implementations — memorize them verbatim.
Subject/Object/Reference Monitor/Operation
Subject = who, Object = what, Reference Monitor = the checker, Operation = the action. This maps directly onto Authentication (into the monitor) and Authorization (out of the monitor, granted).
"Something you are" is strongest
In 2FA, biometrics ("something you are") is the hardest factor to forge or spoof — a commonly tested fact.
Quick Reference — Everything at a Glance
| Topic | Key Point |
|---|---|
| Access control | Selective restriction of access; determines who can access what |
| Subject | User/process wanting access |
| Object | Resource being accessed |
| Reference Monitor | Checks access rules for restrictions |
| Operation | Action taken by subject on object |
| Separation of Duties | Breaks authorization into steps across multiple individuals |
| Need-to-know | Access limited to info required for the task |
| Least Privilege (POLP) | Not more, not less access than needed |
| MAC | Admin/system owner assigns all privileges (SELinux, Trusted Solaris) |
| DAC | Owner controls access to their own info (Windows file permissions) |
| RBAC | Permissions assigned by role (JEA, WAC) |
| RB-RBAC | Roles assigned dynamically via admin-defined rules |
| IAM | Right individual, right access, right time |
| Identity Management (IDM) | Storing/managing user attributes (username, roles, etc.) |
| Identity Repository | Database storing user identity attributes |
| Access Management (AM) | Covers authentication + authorization |
| Password authentication | Username+password vs DB; vulnerable to brute force/dictionary attacks |
| Smart card authentication | Chip device + PIN; cryptography-based, stronger than passwords |
| Biometric authentication | Fingerprint, retina, iris, vein, face, voice |
| Two-factor authentication | Two of: know, have, are — "are" hardest to spoof |
| SSO | Authenticate once, access many systems; reduces password fatigue & traffic |
| Centralized authorization | Single unit/DB for all resources; cheap and simple |
| Decentralized authorization | Each resource has its own authorization unit/DB |
| Implicit authorization | Access via a primary resource, on behalf of others |
| Explicit authorization | Separate authorization required per resource |
| Accounting | Tracks who/when/how users access the network; supports forensics |
| Accountability | Umbrella of identity + authentication + authorization, all logged |
| IAAA chain | Identification → Authentication → Authorization → Accounting |