Access control fundamentals
Access control as policy, mechanism and assurance, how it differs from authentication and authorisation, and the access matrix that every scheme in this module is built from.
- Distinguish access control from authentication and from authorisation.
- Place access control within the policy, mechanism and assurance framework.
- Read an access control matrix and explain what each row and column means.
10 min read
Intuition
A shared system has more than one principal on it, and not everyone on it should be able to do everything. A bank’s customer should not be able to open the vault. A program should not be able to read another user’s passwords. Access control is the part of a security policy that decides, for every principal and every resource, exactly what that principal may do with it.
Mechanism
Access control sits inside the same reference framework as the rest of this unit. It is specified as policy, what is and is not allowed, enforced by one or more mechanisms, and backed by assurance, how much confidence there is that the mechanism actually works. A password is a mechanism. How strong that password is sets how much assurance it provides. The policy itself counters the incentives of an attacker who wants access to a resource or asset they are not entitled to.
Compare
The process of acquiring evidence of the identity of another party. It answers “who are you?”
The allocation of a privilege to a party. It answers “what are you allowed to do?”, and only makes sense once authentication has answered the first question.
Mechanism
Access control itself is neither of those two things. It is the ongoing decision of which principal, a
user, a group, a process or a machine, may do what to which resource. That decision is usually modelled as a
matrix: subjects (principals) down the rows, objects (resources) across the columns, and each cell holding the
rights that subject has over that object, r for read, w for write, x for execute, - for nothing. Every
scheme covered later in this module, discretionary and mandatory control, access control lists, capabilities,
is a different way of storing or enforcing exactly this matrix.
Sam is the administrator: full access everywhere except the audit trail, which even he can only read. Alice, the manager, can run the OS and the program through their approved interfaces but not write to either — she can tamper with data, not with the tools — and she cannot see the audit trail at all. Bob, the auditor, can read everything and change nothing. (source: Week 3 notes, Table 1)
Exam detail
The unit’s own worked example is Table 1 in the Week 3 notes: Sam, Alice and Bob against six objects. Sam is the administrator, with full access everywhere except the audit trail, which even he can only read. Alice, the manager, can execute the operating system and the program through their approved interfaces, but cannot write to either, and she has no access to the audit trail at all. Bob, the auditor, can read every object and write to none. Read a cell as “what this row’s subject may do to this column’s object”, and the whole table follows from each person’s role.
Pitfall
Do not write “access control” when you mean “authentication”, or the reverse. A system can authenticate a user correctly and still make the wrong authorisation decision, and a badly authenticated identity can still be correctly authorised once it is, wrongly, accepted. They are two separate failures with two separate causes.
Threat
A principal granted more rights than its role needs can misuse them, whether by a deliberate attack or by an honest mistake. The larger the gap between what a principal can do and what it actually needs to do, the more damage that gap allows.
Control
The lecture’s own matrix is built to close that gap for each person individually: Alice’s rights stop at reading and writing the data she manages, and never extend to the operating system or program she merely runs. Designing the matrix cell by cell, against what each subject’s role actually requires, is what keeps that gap small in the first place.
Recall
A cell in the access control matrix is empty for subject S and object O. What does that mean?
S has no rights over O at all: not read, not write, not execute. An empty cell is not a missing entry to be filled in later; it is itself a decision.
Aside
The matrix in Table 1 is deliberately called “naive” in the lecture’s own slides. Storing it as a literal grid does not scale: most cells are empty, and a real system needs a cheaper way to store the same information. That is exactly the problem the next topic solves.
Source
Week 3 notes PDF