Access control

What is access control in simple words

Access control is a set of rules, methods and technologies that determine who is allowed to enter physical territory or use information resources. In simple words, it is a system that answers the questions: "Who are you?", "Confirm that it is you" and "What are you allowed to do?".

Imagine an ordinary office: at the entrance there is a security guard who checks passes. This is physical access control. In the digital world, everything is the same: when you enter a login and password to access a system, you undergo digital access control. Without this system, anyone could get into your account or your premises, and security would be at risk.

Access control is a fundamental mechanism for ensuring information security along with identification, authentication and audit. These processes are closely related: first the system identifies the user (determines who they are), then authenticates them (checks authenticity), and only after that authorizes them (allows or denies access to specific resources).

Effective access control allows preventing unauthorized access to information, protecting critical resources and ensuring compliance with regulator requirements. Without access control, a modern corporate IT infrastructure or a physical security system is impossible to imagine.

Access control models

• Discretionary access control (DAC): The owner of a resource assigns access rights themselves. This is the most flexible model, but it requires the active participation of the owner in rights management. Used in small organizations and in systems with low security requirements.
• Mandatory access control (MAC): Access based on security labels assigned to objects and subjects. Used in government systems and systems with high security requirements, where a strict hierarchy of access levels is necessary.
• Role-based access control (RBAC): Rights are assigned to roles, not to individual users. This is the most common model in corporate systems, as it simplifies access management in large organizations. For example, the roles "Accountant" and "Manager" have different rights in the system.
• Attribute-based access control (ABAC): Access based on the attributes of the subject, object, action and environment. This is the most flexible and modern model, allowing the creation of complex access rules. For example, access can be allowed only during working hours, from a corporate device and from the office network.

The choice of model depends on security requirements, system architecture and organization size. Large government systems often use combined approaches, for example, RBAC with elements of ABAC for more flexible access management.

In addition, there are specialized models, such as granular access (access at the level of individual records or fields) and dynamic access (rights can change depending on the current situation). The choice of a specific model should be based on a thorough analysis of threats and security requirements.

Implementation tools

• Software tools: Active Directory, LDAP (Lightweight Directory Access Protocol), identity and access management systems (IAM). They allow centralized management of accounts and access rights.
• Hardware tools: access control systems (ACS), controllers, readers. They provide physical access control at facilities.
• Biometric systems: Biomark (fingerprints), Biovizum (face recognition). They provide a high level of security, since biometric characteristics cannot be forged or transferred to another person.
• Workstations for document verification: ARM-1, ARM-2, used at checkpoints and in identity verification systems.

These tools can work separately or together, forming a unified access control system. For example, a large organization may use Active Directory for digital access control and an ACS with biometrics for physical access control to premises at the same time.

The design service includes the choice of a model, development of policies and integration of all components into a unified system. This is a complex task requiring consideration of many factors: from security requirements to budget and architecture of the existing IT infrastructure. Read more about approaches in the technologies section.