Access Control Fundamentals

In information security, access control is imperative to ensure confidentiality, integrity, and availability. Controlling who has access to a system and the breadth of access a user has is vital to ensure the security of systems and data on the systems. Read this article to understand the terms access control, access, subject, and resource. Note the challenges, the principles, the criteria, and the practices used in access control.

8. Access Control Categories

8.3. Technical

Technical controls called logical controls are the s/w tools used to restrict the subject’s access to objects. They can be core OS components, add-on security packages, applications, n/w h/w devices, protocols, encryption mechanisms, and access control metrics.

They protect the integrity and availability of resources by limiting the number of subjects that can access them and protect the confidentiality of resources by preventing disclosure to unauthorized subjects.


Technical Control Components


System Access
  • In this type, control of access to resources is based on the sensitivity of data, clearance level of users, and user’s rights and permissions. As technical control for system access can be a user name password, Kerberos implementation, biometrics, PKI, RADIUS, TACACS, or authentication using smartcards.


Network Access
  • This control defines the access control mechanism to access different network resources like routers, switches, firewalls, bridges, etc.


Encryption and protocols
  • These controls are used to protect information as it passes throughout an n/w and resides on computers. They preserve the confidentiality and integrity of data and enforce specific paths for communication to take place.


Auditing
  • These controls track activity within a n/w, on a n/w device, or on a specific computer . They help to point out the weaknesses of other technical controls and make the necessary changes.


Network Architecture
  • This control defines the logical and physical layout of the network, and also the access control mechanisms between different n/w segments.


Examples of Technical Controls

  • ACLs
  • Routers
  • Encryption
  • Audit logs
  • IDS
  • Antivirus software
  • Firewalls
  • Smart cards
  • Dial-up call-back systems
  • Alarms and alerts