What is Access Control?
Access control is a system that decides who can use a resource, what they can do with
it, and under what conditions. For example, a company may allow an employee to access
their work computer only during office hours.
To enforce access control, three key steps are involved:
1. Identification: Finding out who the user is (e.g., entering a username).
2. Authentication: Confirming that the user is who they claim to be (e.g., by entering
a correct password or scanning their fingerprint).
3. Authorization: Deciding what the user is allowed to do (e.g., view, edit, or delete
a file).
Authentication Factors
Authentication is the process of proving your identity, and it is done using:
1. Something You Know: Like a password or PIN.
Example: Logging into your email with a password.
2. Something You Have: Like a smart card or an OTP (One-Time Password).
Example: Receiving a security code on your phone.
3. Something You Are: Unique personal features like fingerprints or facial
recognition.
Example: Using Face ID to unlock your phone.
Multi-Factor Authentication (MFA):
This means using two or more of the above methods together. For instance, you might log
in with a password (something you know) and a fingerprint (something you are) for extra
security.
Types of Access Control Models
Access control works using different models. Each model has its own way of deciding
who gets access:
1. Attribute-Based Access Control (ABAC):
Access depends on certain attributes or conditions.
For example:
Allowing access only if the user is part of the “Sales Team” and the request is during
working hours.
2. Discretionary Access Control (DAC):
The owner of the resource (like a file) decides who gets access.
Example: A document’s creator shares it only with specific colleagues.
3. Mandatory Access Control (MAC):
Access is controlled by strict rules set by a central authority
Example: Only employees with “Top Secret Clearance” can access certain files.
4. Role-Based Access Control (RBAC):
Access is given based on job roles.
Example: A manager can view and edit employee records, but a regular employee
cannot.
5. Rule-Based Access Control (RAC):
Access depends on predefined rules or conditions.
Example: Students can access a school lab only from 9 AM to 5 PM.
6. History-Based Access Control (HBAC):
Access is decided by analyzing the user’s previous actions or behavior.
Example: Blocking access if unusual activity is detected, like logging in from a new
country.
7. Identity-Based Access Control (IBAC):
Access is tied to individual identities.
Example: Assigning custom permissions to a user based on their specific needs.
8. Organization-Based Access Control (OrBAC):
Access policies are set for the organization as a whole, without focusing on individuals.
Example: A company-wide rule that all employees can access the intranet.
Types of Access Control
Access control can be applied in two main ways:
1. Physical Access Control:
Controls entry to physical locations like buildings or server rooms.
Example: Employees scan ID cards to enter the office.
2. Logical Access Control:
Controls who can use digital systems like computers, files, or networks.
Example: Requiring a password to log into your laptop.
Challenges in Access Control
Implementing access control can face difficulties:
1. Managing Distributed Systems:
Today’s IT systems often combine cloud services with on-site networks, making it harder
to control access consistently
2. Creating and Applying Policies:
Organizations must write clear policies, and IT teams must convert these into working
systems. Coordination is essential.
3. Monitoring and Reporting:
Regularly checking logs helps detect unusual activity and ensures compliance with rules.
How Access Control Works
Step 1: A user tries to log in by providing their credentials (like a password or
fingerprint).
Step 2: The system checks if the credentials are correct. If they are valid, the user
is authenticated.
Step 3: The system looks at the user’s permissions to decide what they can do.
For extra security, many systems use multi-factor authentication to verify users in more
than one way.
