What is access control?
Access control is a fundamental component of data security that dictates who’s allowed to access and use company information and resources. Through authentication and authorization, access control policies make sure users are who they say they are and that they have appropriate access to company data. Access control can also be applied to limit physical access to campuses, buildings, rooms, and data centers.
How does access control work?
Access control identifies users by verifying various login credentials, which can include usernames and passwords, PINs, biometric scans, and security tokens. Many access control systems also include multifactor authentication (MFA), a method that requires multiple authentication methods to verify a user’s identity.
Once a user is authenticated, access control then authorizes the appropriate level of access and allowed actions associated with that user’s credentials and IP address.
There are four main types of access control. Organizations typically choose the method that makes the most sense based on their unique security and compliance requirements. The four access control models are:
Discretionary access control (DAC):
In this method, the owner or administrator of the protected system, data, or resource sets the policies for who is allowed access.
Mandatory access control (MAC):
In this nondiscretionary model, people are granted access based on an information clearance. A central authority regulates access rights based on different security levels. This model is common in government and military environments.
Role-based access control (RBAC):
RBAC grants access based on defined business functions rather than the individual user’s identity. The goal is to provide users with access only to data that’s been deemed necessary for their roles within the organization. This widely used method is based on a complex combination of role assignments, authorizations, and permissions.
Attribute-based access control (ABAC):In this dynamic method, access is based on a set of attributes and environmental conditions, such as time of day and location, assigned to both users and resources.
Why is access control important?
Access control keeps confidential information such as customer data, personally identifiable information, and intellectual property from falling into the wrong hands. It’s a key component of the modern zero-trust security framework, which uses various mechanisms to continuously verify access to the company network. Without robust access control policies, organizations risk data leakage from both internal and external sources.
Access control is particularly important for organizations with hybrid cloud and multi-cloud cloud environments, where resources, apps, and data reside both on-premises and in the cloud. Access control can provide these environments with more robust access security beyond single sign-on (SSO), and prevent unauthorized access from unmanaged and BYO devices.
Access control policy: Key considerations
Most security professionals understand how critical access control is to their organization. But not everyone agrees on how access control should be enforced, says Chesla. “Access control requires the enforcement of persistent policies in a dynamic world without traditional borders,” Chesla explains. Most of us work in hybrid environments where data moves from on-premises servers or the cloud to offices, homes, hotels, cars and coffee shops with open wi-fi hot spots, which can make enforcing access control difficult.
“Adding to the risk is that access is available to an increasingly large range of devices,” Chesla says, including PCs, laptops, smart phones, tablets, smart speakers and other internet of things (IoT) devices. “That diversity makes it a real challenge to create and secure persistency in access policies.”
In the past, access control methodologies were often static. “Today, network access must be dynamic and fluid, supporting identity and application-based use cases,” Chesla says.
A sophisticated access control policy can be adapted dynamically to respond to evolving risk factors, enabling a company that’s been breached to “isolate the relevant employees and data resources to minimize the damage,” he says.
Enterprises must assure that their access control technologies “are supported consistently through their cloud assets and applications, and that they can be smoothly migrated into virtual environments such as private clouds,” Chesla advises. “Access control rules must change based on risk factor, which means that organizations must deploy security analytics layers using AI and machine learning that sit on top of the existing network and security configuration. They also need to identify threats in real-time and automate the access control rules accordingly.”
-Types of access control
Organizations must determine the appropriate access control model to adopt based on the type and sensitivity of data they’re processing, says Wagner. Older access models include discretionary access control (DAC) and mandatory access control (MAC), role based access control (RBAC) is the most common model today, and the most recent model is known as attribute based access control (ABAC).
Discretionary access control (DAC)
With DAC models, the data owner decides on access. DAC is a means of assigning access rights based on rules that users specify.
Mandatory access control (MAC)
MAC was developed using a nondiscretionary model, in which people are granted access based on an information clearance. MAC is a policy in which access rights are assigned based on regulations from a central authority.
Role Based Access Control (RBAC)
RBAC grants access based on a user’s role and implements key security principles, such as “least privilege” and “separation of privilege.” Thus, someone attempting to access information can only access data that’s deemed necessary for their role.
Attribute Based Access Control (ABAC)
In ABAC, each resource and user are assigned a series of attributes, Wagner explains. “In this dynamic method, a comparative assessment of the user’s attributes, including time of day, position and location, are used to make a decision on access to a resource.”
It’s imperative for organizations to decide which model is most appropriate for them based on data sensitivity and operational requirements for data access. In particular, organizations that process personally identifiable information (PII) or other sensitive information types, including Health Insurance Portability and Accountability Act (HIPAA) or Controlled Unclassified Information (CUI) data, must make access control a core capability in their security architecture, Wagner advises.
Access control solutions
A number of technologies can support the various access control models. In some cases, multiple technologies may need to work in concert to achieve the desired level of access control, Wagner says.
“The reality of data spread across cloud service providers and SaaS applications and connected to the traditional network perimeter dictate the need to orchestrate a secure solution,” he notes. “There are multiple vendors providing privilege access and identity management solutions that can be integrated into a traditional Active Directory construct from Microsoft. Multifactor authentication can be a component to further enhance security.”
Why authorization remains a challenge
Today, most organizations have become adept at authentication, says Crowley, especially with the growing use of multifactor authentication and biometric-based authentication (such as facial or iris recognition). In recent years, as high-profile data breaches have resulted in the selling of stolen password credentials on the dark web, security professionals have taken the need for multi-factor authentication more seriously, he adds.
Authorization is still an area in which security professionals “mess up more often,” Crowley says. It can be challenging to determine and perpetually monitor who gets access to which data resources, how they should be able to access them, and under which conditions they are granted access, for starters. But inconsistent or weak authorization protocols can create security holes that need to be identified and plugged as quickly as possible.
Speaking of monitoring: However your organization chooses to implement access control, it must be constantly monitored, says Chesla, both in terms of compliance to your corporate security policy as well as operationally, to identify any potential security holes. “You should periodically perform a governance, risk and compliance review,” he says. “You need recurring vulnerability scans against any application running your access control functions, and you should collect and monitor logs on each access for violations of the policy.”
In today’s complex IT environments, access control must be regarded as “a living technology infrastructure that uses the most sophisticated tools, reflects changes in the work environment such as increased mobility, recognizes the changes in the devices we use and their inherent risks, and takes into account the growing movement toward the cloud,” Chesla says.