Access control is a security mechanism that determines who can access certain resources, such as files, folders, applications, or websites. Authentication is a crucial aspect of access control, which involves verifying the identity of users through various methods, such as passwords, biometric data, or security tokens. Authorization is another key element of access control which involves granting users the necessary access rights to specific resources based on their roles or attributes.
According to a survey conducted by Centrify, 74% of data breaches were the result of privileged credential abuse, making it the leading cause of cybersecurity incidents. This finding aligns with the Verizon 2017 Data Breach Investigation Report, which indicated that a staggering 81% of breaches were directly related to stolen, weak, or default passwords that organizations failed to change. These reports emphasize the need for companies to recognize the importance of robust access control systems in order minimize the risk of data breaches.
What Is Access Control?
Understanding access control systems requires knowing who should have access to what, the guidelines governing access, and the mechanisms for tracking access events. Access control systems typically maintain records of every individual’s entry into the system. Organizations must carefully consider the level of ownership they will have over the system and establish a clear criteria for determining which employees are granted access to specific resources.
What Are Access Control Models?
Various models of access control systems exist, each offering unique advantages and suitability for different scenarios. Understanding the fundamentals of access control systems, including user identification, authentication and the various access control models, is essential for establishing an effective and secure access management strategy.
What Are The 4 Main Access Control Models?
There are three commonly cited access control models, which include; Discretionary access control, Mandatory access control and Role-based access control. However, Rule-based access control is another lesser-known model that I have included for good measure. These different models are described below:
1. Discretionary Access Control (DAC)
Discretionary Access Control (DAC) systems empower leaders with the authority to determine who can access specific resources, overriding potential limitations imposed by file hierarchies and permissions set by system administrators. However, this advantage comes with the responsibility of oversight, as end-users are tasked with managing security levels. The active involvement required in managing permissions within DAC systems increases the risk of oversights. In contrast, mandatory access control (MAC) systems offer a less flexible approach but demand less effort from the user. Ultimately, DAC systems strike a balance between flexibility and administrative burden, requiring organizations to weigh the need for granular control against the potential for oversight.
2. Mandatory Access Control (MAC)
Mandatory Access Control (MAC) systems provide the most stringent security measures to safeguard sensitive data and resources. Within a MAC system, the authority to grant access rests solely with system administrators, ensuring that only authorized individuals can gain entry to specific areas or resources. Users are unable to modify permissions, preventing unauthorized modifications that could compromise data integrity. Moreover, MAC systems limit the resource owner’s ability to grant access to listed items, further enhancing security. Each employee is assigned a unique ‘tag’ that determines their access level, enabling fine-grained control over resource accessibility. Access to resources is restricted based on the tag and the sensitivity of the information, providing a tailored approach to security. MAC systems are commonly employed by government entities and organizations that handle highly confidential information, demonstrating their effectiveness in maintaining data security and ensuring compliance with regulatory standards.
3. Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC) is the most commonly used access control system, which grants permissions to users based on their roles and responsibilities within a company. Access rights are determined by various factors, such as the resources required, user needs, the environment, job function, location, and more. RBAC simplifies the grouping of employees based on the resources they need to access and offers a flexible model that enhances visibility while ensuring protection against security breaches.
4. Rule-Based Access Control (RuBAC)
Rule-Based Access Control (RuBAC) is a security model that uses an algorithm to adjust permissions based on conditions such as a users’ location or the time of day they access the system. RuBAC relies on structured rules and policies to grant access, which involves checking the rules defined in an access control list for each resource when a user attempts to access it. Implementing RuBAC requires effort in creating the rules, policies, and context, and it is often combined with the role-based approach. However, setting up and maintaining this model can be challenging, especially when dealing with time-based access to multiple parts of the network.
How Lepide Helps Strengthen Access Control
The Lepide Data Security Platform helps to strengthen access control by discovering and classifying sensitive data across unstructured data stores, and providing visibility into how sensitive data is accessed and used. The platform identifies privileged users, tracks the movement of sensitive information and logon/logoff activities via a user-friendly interface. Advanced machine learning techniques are used for detecting anomalies, and real-time alerts can be sent to the relevant personnel for quick remediation of potential threats. The platform also provides a comprehensive timeline of events, assisting in forensic analysis after incidents.
If you’d like to see how the Lepide Data Security Platform can help to harden your access controls systems, start your free trial today.
Important Group Policy Settings & Best Practices to Prevent Security Breaches
15 Most Common Cyber Attack Types and How to Prevent Them
Why Active Directory Account Getting Locked Out Frequently – Causes
