1 Fundamentals
Access control is the set of rules and mechanisms that determine whether a requester may interact with a resource. It is a foundational security function in computing and in physical environments, helping organizations limit exposure of data, services, devices, and facilities. Effective access control depends on clearly defined identities, permissions, and enforcement methods.
1.1 Definition and purpose
The purpose of access control is to ensure that only authorized users, systems, or processes can perform specific actions. Those actions may include reading a file, modifying a record, running a program, opening a door, or issuing an administrative command. By restricting access, organizations reduce the likelihood of unauthorized disclosure, alteration, disruption, or misuse.
1.2 Security objectives
Access control supports several security objectives. It helps preserve confidentiality by preventing unauthorized viewing, supports integrity by limiting unwanted changes, and contributes to availability by reducing malicious or accidental interference. In many environments, it also provides accountability by linking actions to identifiable subjects.
1.3 Core concepts
Access control is commonly described through a small set of basic concepts that appear across systems and policy models.
1.3.1 Subject
A subject is the active entity requesting access. It may be a person, application, service account, device, or automated process. The subject is the actor whose identity and privileges are evaluated before access is granted.
1.3.2 Object
An object is the protected resource being accessed. Objects include files, database rows, network services, hardware components, and physical spaces. The protection rules associated with an object define what actions are allowed.
1.3.3 Permission
A permission is an approved action on an object, such as read, write, execute, delete, or administer. Permissions are usually assigned according to policy and may be narrow or broad depending on the sensitivity of the resource.
1.3.4 Privilege
A privilege is an elevated right that allows a subject to perform sensitive or administrative actions. Privileges are often more powerful than ordinary permissions and therefore require stricter controls, monitoring, and review.
1.4 Relationship to authentication and authorization
Access control is closely related to authentication and authorization, but the terms are not identical. Authentication confirms the identity of a subject, while authorization determines what that authenticated subject may do. Access control includes both of these steps and adds enforcement, meaning the actual technical or physical blocking of unauthorized activity.
2 Access control models
Access control models are structured ways of deciding who may access what. Different models suit different environments, risk levels, and administrative needs. Many real systems combine more than one model.
2.1 Discretionary access control
Discretionary access control lets the owner of a resource decide who can use it. File permissions in many operating systems are a common example. This model is flexible, but it can also lead to inconsistent decisions if users grant access too freely.
2.2 Mandatory access control
Mandatory access control uses centrally defined rules that users cannot easily override. Access decisions are based on labels, classifications, or clearances set by the system or an authority. This approach is often used where strong control and uniform enforcement are required.
2.3 Role-based access control
Role-based access control assigns permissions to roles rather than directly to individuals. Users receive access by being placed into roles such as manager, auditor, or operator. This simplifies administration in organizations where many people need similar access patterns.
2.4 Attribute-based access control
Attribute-based access control evaluates access using attributes of the subject, object, action, and context. Attributes may include department, device type, location, time of day, or data sensitivity. This model is highly expressive and works well in dynamic environments.
2.5 Rule-based access control
Rule-based access control uses explicit rules to determine access. Rules may depend on conditions such as network address, time limits, or request type. It is often applied as a policy layer that supplements another access model.
2.6 Capability-based access control
Capability-based access control grants access through unforgeable tokens or references that confer specific rights. Possession of the capability is itself evidence of authority. This model can reduce reliance on centralized lookups, but capability management must be handled carefully.
3 Access control mechanisms
Access control mechanisms are the technical tools used to enforce policy. They translate abstract rules into operating system settings, software checks, network controls, or hardware constraints.
3.1 Access control lists
Access control lists specify which subjects may access an object and what operations they may perform. They are widely used for files, directories, printers, and network resources. ACLs are straightforward to understand, though they can become complex in large systems.
3.2 Access tokens and keys
Access tokens and keys act as proof that a subject has been granted certain rights. Tokens may be short-lived and digitally signed, while keys may unlock encrypted content or authenticate a request. Their security depends on careful issuance, storage, and expiration handling.
3.3 Privilege levels
Privilege levels divide system capabilities into tiers, such as standard user, power user, or administrator. Separating privileges limits the damage that can result from mistakes or compromise. Many systems reserve the highest level for tightly controlled tasks.
3.4 Policy engines
Policy engines evaluate requests against formal rules and return allow or deny decisions. They can centralize authorization logic across multiple applications or services. In advanced deployments, policy engines may combine identity, context, and risk signals.
3.5 Session management
Session management maintains the state of an authenticated interaction after login. It governs how long access remains valid, when sessions expire, and how reauthentication is handled. Poor session management can undermine otherwise strong access controls.
4 Authentication and identity
Identity systems establish who or what is making a request. Reliable identification and authentication are prerequisites for sound authorization decisions.
4.1 Identification methods
Identification methods present an identity claim, such as a username, employee number, device certificate, or service identifier. The identifier does not by itself prove legitimacy; it simply states who the requester claims to be. Authentication then validates that claim.
4.2 Password-based authentication
Password-based authentication remains common because it is simple and inexpensive to deploy. Its security depends on password strength, uniqueness, storage protection, and resistance to guessing or reuse. Weak passwords and poor user habits can significantly reduce effectiveness.
4.3 Multi-factor authentication
Multi-factor authentication requires two or more distinct types of evidence, such as something known, something possessed, or something inherent. It strengthens access control by making stolen credentials less useful on their own. Many systems use it for sensitive accounts and high-risk transactions.
4.4 Biometrics
Biometrics use physical or behavioral traits such as fingerprints, facial patterns, voice, or typing rhythm. They can improve convenience and reduce reliance on memorized secrets. Because biometric traits are not easily changed, systems usually combine them with other safeguards.
4.5 Single sign-on
Single sign-on allows a user to authenticate once and then access multiple services without repeated logins. It improves usability and can centralize identity management. At the same time, the single sign-on system becomes a critical trust point that must be well protected.
4.6 Identity federation
Identity federation enables one organization or system to accept identity assertions from another trusted source. This reduces duplicate accounts and simplifies access across domains. Federation is common in enterprise and cloud environments where users need access to multiple connected services.
5 Authorization and permissions
Authorization determines the scope of actions that a verified subject may perform. It translates policy into concrete permissions and governs how those permissions are assigned, limited, and shared.
5.1 Permission assignment
Permission assignment is the process of granting rights to users, groups, roles, or systems. Effective assignment aligns access with job duties and operational needs. Overly broad permissions create unnecessary risk, while overly narrow permissions can hinder work.
5.2 Least privilege
Least privilege means giving a subject only the access needed to complete a task. This principle reduces the potential impact of compromise, error, or misuse. It is one of the most important ideas in access control design.
5.3 Separation of duties
Separation of duties divides sensitive tasks among different people or roles so that no single subject controls an entire critical process. This helps prevent fraud and reduces the chance of undetected abuse. It is often used in finance, administration, and security operations.
5.4 Delegation of authority
Delegation of authority allows a subject to pass limited rights to another subject. The delegated access is usually constrained by scope, time, or task. Proper delegation requires safeguards so that authority is not expanded beyond what was intended.
5.5 Temporary access
Temporary access grants permissions for a limited period or specific event. It is useful for contractors, emergencies, audits, and short-term projects. Automatic expiration is an important feature because it prevents forgotten privileges from lingering.
6 Access control enforcement
Enforcement is the practical act of applying access decisions. It can occur in software, hardware, network devices, or physical security systems.
6.1 Operating system enforcement
Operating systems enforce access through file permissions, process privileges, user accounts, and kernel controls. They decide whether a process may read a file, bind to a port, or access protected memory. Strong system-level enforcement underpins many higher-level security measures.
6.2 Network access control
Network access control limits which devices or users may connect to a network or service. It may use port checks, device identity, endpoint posture, or segment-based restrictions. This helps prevent unauthorized or unmanaged devices from reaching sensitive resources.
6.3 Application-layer enforcement
Application-layer enforcement occurs inside software that interprets business rules and user roles. Applications may check whether a requester can view a record, submit a form, or perform an administrative function. Because these checks happen close to the data, they are essential in web and mobile systems.
6.4 Database access control
Database access control governs who can query, change, or administer stored data. It may be organized by tables, views, rows, columns, or stored procedures. Fine-grained database controls help protect sensitive records even when applications share the same database.
6.5 Cloud access control
Cloud access control manages permissions for cloud services, storage, and infrastructure resources. It often combines identity-based policies, service roles, and temporary credentials. Because cloud environments are highly dynamic, consistent policy design is especially important.
6.6 Physical access control
Physical access control regulates entry to buildings, rooms, racks, or devices. It may use badges, locks, guards, PINs, or biometric readers. Physical safeguards complement digital controls by protecting hardware and infrastructure from direct tampering.
7 Policy design and administration
Policy design turns security goals into rules that can be consistently administered. Good administration keeps access aligned with organizational needs over time.
7.1 Access control policies
Access control policies define who should receive access, under what conditions, and for what purpose. They may be documented in formal standards or embedded in system configurations. Clear policies reduce ambiguity and support consistent decisions.
7.2 Access reviews and audits
Access reviews and audits examine whether permissions still match current responsibilities and whether controls are being followed. Regular review can reveal excessive privileges, inactive accounts, or inconsistencies. Audits also help demonstrate accountability and support governance.
7.3 Provisioning and deprovisioning
Provisioning is the creation or assignment of accounts and permissions, while deprovisioning removes them when no longer needed. Timely provisioning supports productivity, and timely removal reduces residual risk. Automated workflows can improve both speed and accuracy.
7.4 Change management
Change management governs modifications to access policies, roles, and technical controls. It helps ensure that updates are reviewed, tested, documented, and approved. Careful change control reduces accidental exposure caused by configuration errors.
7.5 Exception handling
Exception handling addresses cases where standard rules do not fit a legitimate need. Exceptions may be temporary, formally approved, and closely monitored. Without structure, exceptions can become informal back doors that weaken security.
8 Security considerations
Access control is effective only when it accounts for common threats and operational realities. The quality of the overall system depends on both technical safeguards and administrative discipline.
8.1 Insider threats
Insider threats arise when trusted users misuse access intentionally or accidentally. Because insiders often already have legitimate credentials, their actions may be harder to detect. Limiting privileges and monitoring behavior can reduce the risk.
8.2 Credential theft
Credential theft occurs when passwords, tokens, keys, or other secrets are stolen and reused. Attackers may obtain credentials through phishing, malware, or poor storage practices. Strong authentication and credential protection help limit this problem.
8.3 Privilege escalation
Privilege escalation happens when a subject gains more authority than intended. It may result from software flaws, configuration errors, or misuse of delegated rights. Preventing escalation requires patching, least privilege, and careful boundary checks.
8.4 Access revocation
Access revocation removes rights that are no longer appropriate. Delays in revocation can leave former employees, contractors, or systems with unnecessary access. Fast, reliable revocation is a critical part of the control lifecycle.
8.5 Logging and monitoring
Logging and monitoring record access events and help detect unusual behavior. Useful logs identify who accessed what, when, and from where. Monitoring supports investigation, alerting, and compliance, but it must be balanced with privacy and operational concerns.
8.6 Usability and security tradeoffs
Stronger access control can sometimes make systems harder to use. Excessive prompts, complex procedures, or rigid restrictions may encourage workarounds. Effective design seeks a practical balance that protects resources without creating unnecessary friction.
9 Standards and implementations
Access control is implemented through a range of standards, protocols, and product designs. These implementations make it possible to share identity and authorization information across systems.
9.1 Common protocols
Common access-related protocols support authentication, authorization, and identity exchange across applications and organizations.
9.1.1 Kerberos
Kerberos is a network authentication protocol that uses tickets to prove identity without repeatedly transmitting passwords. It is designed for trusted environments where centralized authentication is desirable. Its ticket-based structure supports secure single sign-on.
9.1.2 OAuth
OAuth is an authorization framework that allows one service to obtain limited access to resources on behalf of a user. It is widely used for delegated access to APIs and third-party applications. OAuth focuses on authorization rather than direct identity proof.
9.1.3 SAML
SAML is a standard for exchanging authentication and authorization information between identity providers and service providers. It is often used for enterprise single sign-on across web applications. SAML assertions convey trusted identity statements.
9.1.4 OpenID Connect
OpenID Connect builds identity layers on top of OAuth to provide authentication as well as authorization-related functions. It is commonly used in modern web and mobile applications. The protocol supports federated sign-in with standardized identity claims.
9.2 Enterprise access control systems
Enterprise access control systems manage identities, groups, roles, and permissions across large organizations. They often integrate directories, policy engines, audit tools, and provisioning workflows. Centralization helps maintain consistency, though integration can be complex.
9.3 Access control in operating systems
Operating systems provide core access control features such as user accounts, group permissions, process isolation, and administrative privileges. These controls govern local resources and often serve as the base layer for application security. Advanced systems may also include sandboxing and mandatory policy modules.
9.4 Access control in web applications
Web applications implement access control through server-side checks, session handling, role logic, and API authorization. Good design ensures that permissions are verified on the server rather than relying on interface elements alone. Web systems must also protect against direct object reference and other authorization flaws.
10 Evaluation and testing
Access control must be tested to confirm that policy is correctly implemented and that gaps do not exist between intended and actual behavior. Evaluation is necessary both during development and during ongoing operations.
10.1 Security assessment
Security assessment examines whether access control design and configuration meet security requirements. It may include architecture review, configuration analysis, and threat modeling. The goal is to identify weaknesses before they are exploited.
10.2 Compliance checking
Compliance checking compares access practices against internal policy or external requirements. It verifies that permissions, reviews, logs, and approvals are being handled as expected. Automated checks can improve consistency in large environments.
10.3 Penetration testing
Penetration testing attempts to bypass access controls under controlled conditions. Testers may look for broken authorization, weak authentication, or escalation paths. Findings can reveal practical weaknesses that are not obvious in policy documents.
10.4 Access control verification
Access control verification confirms that the system enforces the intended rules for each subject, object, and action. It may involve test cases, code review, and policy validation. Reliable verification reduces the chance that users obtain unintended access.