Access control is the discipline of deciding who can reach an asset, what they can do with it, and under what conditions that access is allowed. The chapter explains that access control protects confidentiality, integrity, and availability by preventing unauthorized disclosure, modification, and disruption while still allowing legitimate users to do their work. It also frames access control around three core elements: subjects that request access, objects that are protected, and rules that determine whether a request is approved or denied.
The chapter then describes the four main stages that make access control work: identification, authentication, authorization, and accountability. A subject first claims an identity, proves it with credentials, is then granted permissions and privileges appropriate to the request, and is finally subject to logging and auditing so actions can be traced. It also discusses authentication methods and factors, showing why multi-factor authentication is stronger than relying on a single secret such as a password.
Finally, the chapter shows how organizations scale access control through identity and access management systems and secure privileged access management for high-risk accounts. It outlines common account types, the lifecycle of provisioning, reviewing, and revoking access, and the need to limit powerful accounts through careful monitoring and temporary elevation. The chapter closes with guiding principles such as least privilege, separation of duties, two-person control, need-to-know, and defense in depth, all of which help reduce abuse, improve accountability, and strengthen overall security.
Illustration of the relationship between subject, objects, and rules.
Illustration of the phases of access control
Summary of identity access management models
Illustration of the setup of a PAM system.
Answers to Review Questions
The correct answer is A. A subject is an individual or entity that is attempting to access assets. Subjects can include individual users, applications, or services. Objects are the things a subject is trying to access. Objects can be files, data, physical devices, or anything a subject requests access to. Rules are instructions created to decide whether a subject should be granted access to an object
The correct answer is D. Authentication typically requires users to provide unique identity factors that others cannot easily replicate. Because no single factor is completely foolproof, no identity factor is ever based on "something you trust.
The correct answer is C. Need to know is a principle that limits access to information to those who require it to do their job. Two-person control is a security measure that requires the cooperation of two people to do a task. To reduce the risk of fraud or error, segregation of duties is the principle of separating certain job functions.
The correct answer is A. According to the principle of Separation of Duties, operations on objects are to be segmented (often referred to as 'transactions'), requiring distinct users and authorizations.
The correct answer is C. The principle of least privilege ensures that users are granted only the minimum access necessary to perform their specific tasks.
FAQ
What is access control in cybersecurity?Access control is the process of determining who or what can access a resource, what actions they can perform, and under what conditions access is granted or denied. It helps protect confidentiality, integrity, and availability.What are the three core components of access control?The three core components are subjects, objects, and rules. A subject requests access, an object is the resource being protected, and rules define whether access is allowed or denied.What is the difference between identification and authentication?Identification is when a subject claims an identity, such as entering a username. Authentication is the process of verifying that claimed identity, such as checking a password, token, or biometric factor.What are the three main authentication factors?The three main authentication factors are something you know, something you have, and something you are. Examples include passwords, smartcards or tokens, and fingerprints or facial scans.Why is multi-factor authentication (MFA) more secure than single-factor authentication?MFA is more secure because it requires two or more independent authentication factors. Even if one factor is compromised, an attacker still has to bypass the additional factor(s) to gain access.What is authorization?Authorization determines what an authenticated subject is allowed to do. It defines the permissions and privileges granted to a user, such as read, write, execute, or administrative actions.What is accountability in access control?Accountability is the ability to trace actions back to a specific user or subject. It is supported by logging, monitoring, and auditing so organizations can investigate incidents and enforce responsibility.What is IAM and why is it important?Identity and Access Management (IAM) is a structured way to manage user identities, permissions, and access rights across an organization. It helps automate access control, reduce errors, support compliance, and manage the full lifecycle of accounts.What is Privileged Access Management (PAM)?PAM is a system for managing privileged accounts and limiting their use to necessary tasks, minimum privileges, and limited time periods. It also helps monitor and log privileged activity for accountability and compliance.What are the main principles of access control?The main principles include least privilege, segregation of duties, two-person control, need-to-know, and defense-in-depth. These principles reduce unnecessary access, prevent fraud, and strengthen overall security.
pro $24.99 per month
access to all Manning books, MEAPs, liveVideos, liveProjects, and audiobooks!
Fundamentals of Cybersecurity ebook for free
