10 Logical Access Controls

Logical access controls are the software-based safeguards that decide who can use digital resources and what they can do with them. They complement physical and administrative controls by protecting systems, applications, networks, and data even when a device is physically accessible. The chapter explains that effective access control depends on identifying users and other entities, authenticating them, authorizing their actions, and keeping them accountable through continuous oversight.

The chapter then compares the main models used to manage permissions at scale. Discretionary access control gives owners flexibility to share resources, but it can create inconsistency and accidental exposure. Mandatory access control uses centrally enforced labels and clearances to protect highly sensitive environments, while role-based access control assigns permissions by job function to make administration simpler and more consistent. It also notes that modern systems often extend these ideas with attribute- and policy-driven approaches for finer-grained decisions.

Beyond permission models, the chapter emphasizes identity management and monitoring as essential parts of security. Directory services, identity providers, single sign-on, and federated identity systems help organizations create centralized, trusted ways to manage accounts and access across multiple systems and even across organizations. The chapter closes by stressing the importance of logging, log centralization, SIEM analysis, and privileged access monitoring to detect suspicious behavior, support audits, and reduce the risks of privilege creep, account misuse, and insider threats.