InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Comprehensive overview of access control concepts, models, and mechanisms for controlling who can access resources in information systems.
What is Access Control?
Access control is a security technique that regulates who or what can view, use, or modify resources in a computing environment. It is a fundamental component of information security that implements the principle of least privilege.
Example
Access Control Decision Process:
==================================
Subject (User/Process) → Requests → Access to Object (Resource)
| |
v v
[Identification] [Classification]
[Authentication] [Sensitivity Level]
[Authorization] ←-- Policy Engine --→ [Access Rules]
| |
v v
GRANT or DENY access
Access Control Components
| Component | Description | Example |
|---|---|---|
| Subject | Entity requesting access | User, process, device |
| Object | Resource being accessed | File, database, API |
| Policy | Rules governing access | "Managers can approve expenses" |
| Mechanism | Technical enforcement | ACLs, RBAC engine, IAM |
Access Control Models
1. Discretionary Access Control (DAC)
- Resource owner decides who gets access
- Flexible but less secure
- Used in: Windows NTFS, Unix file permissions
2. Mandatory Access Control (MAC)
- System enforces access based on security labels
- Rigid but very secure
- Used in: Military/government systems, SELinux
3. Role-Based Access Control (RBAC)
- Access based on organizational roles
- Scalable and manageable
- Used in: Enterprise applications, cloud IAM
4. Attribute-Based Access Control (ABAC)
- Access based on attributes of subject, object, environment
- Most flexible and granular
- Used in: Cloud platforms, modern zero-trust architectures
Example
class AccessControlSystem:
"""Demonstrate different access control models."""
def __init__(self):
self.permissions = {}
self.roles = {}
def check_access(self, subject: str, action: str, resource: str) -> bool:
"""Evaluate access request against policy."""
# Check direct permissions (DAC)
key = (subject, resource)
if key in self.permissions:
return action in self.permissions[key]
# Check role-based permissions (RBAC)
user_roles = self.get_user_roles(subject)
for role in user_roles:
role_perms = self.roles.get(role, {}).get(resource, [])
if action in role_perms:
return True
# Default deny
return False
def grant_permission(self, subject: str, resource: str, actions: list):
"""Grant DAC permission."""
self.permissions[(subject, resource)] = set(actions)
def assign_role(self, user: str, role: str):
"""Assign role for RBAC."""
if user not in self.user_roles:
self.user_roles[user] = []
self.user_roles[user].append(role)
# Example
ac = AccessControlSystem()
ac.grant_permission("alice", "financial_report.pdf", ["read", "write"])
print(ac.check_access("alice", "read", "financial_report.pdf")) # True
print(ac.check_access("alice", "delete", "financial_report.pdf")) # False
print(ac.check_access("bob", "read", "financial_report.pdf")) # False
Access Control Implementation Strategies
| Layer 1 | Physical Access |
| Layer 2 | Network Access |
| Layer 3 | System Access |
| Layer 4 | Application Access |
| Layer 5 | Data Access |
The Principle of Least Privilege
Every subject should have only the minimum access necessary to perform their function:
| Bad Practice | Good Practice |
|---|---|
| All developers have admin access | Devs have read-only prod access |
| Service account has DB owner role | Service account has specific table permissions |
| Everyone shares one admin password | Individual accounts with appropriate roles |
| Root/admin used for daily tasks | Standard user + sudo for specific commands |
Interview Questions
- What is the difference between authentication and authorization?
- Authentication verifies identity (who you are). Authorization determines permissions (what you can do). Authentication must happen before authorization. Example: Logging in = authentication. Accessing admin panel = authorization.
- Explain the principle of least privilege with a real example.
- A web application's database connection should use a user with only SELECT, INSERT, UPDATE permissions on specific tables — not a DBA account. If the application is compromised, the attacker's damage is limited to those specific operations.
- Compare DAC and MAC access control models.
- DAC: Owner controls access, flexible, risk of over-sharing (Windows NTFS). MAC: System enforces labels, rigid, prevents unauthorized sharing (SELinux, classified data). MAC is more secure but less flexible; DAC is practical for most business use.
- What is separation of duties and why is it important?
- No single person should control all aspects of a critical process. Example: The person who creates purchase orders shouldn't also approve them. This prevents fraud and reduces insider threat risk.
- How does Zero Trust differ from traditional perimeter-based access control?
- Traditional: Trust users inside the network, verify at perimeter only. Zero Trust: Never trust, always verify — every request is authenticated and authorized regardless of network location. Assumes breach and minimizes blast radius.
Summary
Access control is the cornerstone of information security, determining who can access what resources and under what conditions. Proper implementation requires understanding different models (DAC, MAC, RBAC, ABAC), applying least privilege, implementing defense in depth, and regularly reviewing and auditing access rights.
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for Introduction to Access Control.
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this Information Security topic.
Search Terms
information-security, information security, information, security, access, control, introduction, introduction to access control
Related Information Security Topics
Continue learning this concept
Access ControlAttribute-Based Access Control (ABAC)Understanding ABAC policies that evaluate multiple attributes of subjects, resources, actions, and environment for fine-grained access decisions.Access ControlDiscretionary Access Control (DAC)Understanding DAC where resource owners control access permissions, including Unix file permissions, Windows ACLs, and security implications.Access ControlMandatory Access Control (MAC)Understanding MAC systems where access decisions are enforced by the system based on security labels, covering Bell-LaPadula, Biba models, and SELinux.Access ControlRole-Based Access Control (RBAC) — Information SecurityUnderstanding RBAC implementation, role hierarchies, permission assignment, and best practices for enterprise access management.Access ControlZero Trust Security ArchitectureComprehensive guide to Zero Trust principles including never trust always verify, microsegmentation, continuous authentication, and implementation strategies.Operating System SecurityOS Access Control ModelsImplementing access control at the operating system level including DAC, MAC, capabilities, and security policies.