Logical Access Control - Explained

 Logical access controls help prevent unauthorized access, modification, or destruction of information, and protect the confidentiality, integrity, and availability of data and systems. Effective implementation of logical access controls is an essential component of an organization's overall information security strategy.

While physical access controls refer to physical means or mechanisms that prevent individuals from gaining entry to a location or asset, logical access controls are electronic measures that prevent unauthorized access to computer systems, and in some cases, tangible assets or areas as well.

• 2 definitions needs to be known before starting to learn about the methods of logical access controls:

  • Authentication: The process of verifying the identity of a user or device attempting to access a system or resource. This can be achieved through various means such as passwords, tokens, biometric factors, or multi-factor authentication.

  • Authorization: The process of granting or denying access to a specific resource or system based on the user's authenticated identity, their assigned role, and privileges

• Logical Access Control Methods:

  • Discretionary Access Control (DAC) is a type of access control method that allows the owner of a resource, typically a file or directory, to have complete control over who can access it and what level of access is granted. The owner can assign permissions to other users or groups, enabling them to read, write, execute, or modify the resource as desired.

    DAC is often used in smaller organizations or environments where there is a lower level of security risk, and where users are trusted to act in good faith. This type of access control is often implemented in operating systems such as Unix and Linux, where file permissions are set by the owner or administrator. The majority of information systems worldwide employ DAC systems. In a DAC system, a user who has been granted access to a file typically has the ability to share or transfer that file to another individual, granting them almost the same level of access as the original owner. Rule-based access control systems are often a variation of DAC.

    Let's see how DAC can be used in the real world:

    1. A small company with a few employees might use DAC to restrict access to sensitive documents to only those employees who require it for their work.

    2. A university might use DAC to give professors access to their own files and directories, while limiting access to other professors or students.

    3. A government agency might use DAC to restrict access to classified information to only those individuals who have the appropriate clearance level and need-to-know.

    While DAC can be a useful access control method, it has limitations in terms of scalability and flexibility, and may not be appropriate for larger organizations with more complex security requirements.

  • Mandatory Access Control (MAC) is an another access control method that enforces a system-wide security policy based on predefined rules and labels, rather than individual user or owner discretion. MAC is often used in high-security environments where the sensitivity of data is critical, such as government or military settings.

    In a MAC system, all resources are assigned security labels based on their sensitivity level, and users are also assigned labels based on their clearance level. The system enforces access based on these labels, ensuring that only users with the appropriate clearance level are able to access sensitive data. MAC policy is one that is consistently applied to all users and resources within an information system. This essentially means that only authorized security administrators, who are considered trusted users, have the ability to make changes to the security rules that apply to users and resources within the system.

    MAC can be used in the real world as:

    1. The United States Department of Defense uses MAC to control access to classified information. All information and users are labeled with a classification level, such as "Top Secret" or "Secret," and access is only granted to individuals with the appropriate clearance level.

    2. Some financial institutions use MAC to control access to financial data and systems, ensuring that only authorized personnel are able to view or modify financial records.

    3. Healthcare organizations may use MAC to control access to electronic health records, ensuring that only authorized healthcare providers are able to view patient data.

    While MAC can be an effective access control method for high-security environments, it can be complex to implement and manage, and may not be appropriate for all organizations.

  • Role-Based Access Control (RBAC) on the other hand assigns access permissions based on the roles that users have within an organization. In an RBAC system, access is granted based on the user's job function, rather than their individual identity or ownership of a resource.

    RBAC typically involves the creation of predefined roles within an organization, with each role having a set of permissions associated with it. Users are then assigned to specific roles, and are granted access only to the resources and functions that are necessary for their role. So RBAC is an access control method that grants permissions to workers based on the roles they have within an organization. For instance, only employees in the Human Resources department would have access to personnel files, while the Finance department would have access to bank accounts. Similarly, managers would have access to their own team's information and resources. In contrast, very high-level system administrators may have access to everything, while new employees would have limited access, enough only to perform their job functions.

  • And here are some examples of how RBAC can be used in the real world:

    1. A hospital may use RBAC to control access to electronic health records. Different roles, such as doctors, nurses, and administrators, would be created with specific permissions based on their job function.

    2. An e-commerce website may use RBAC to control access to customer data. Different roles, such as customer service representatives, warehouse staff, and marketing managers, would be created with specific permissions based on their job function.

    3. A financial institution may use RBAC to control access to financial systems. Different roles, such as traders, compliance officers, and IT administrators, would be created with specific permissions based on their job function.

    RBAC can be a flexible and scalable access control method, and is often used in larger organizations where there are many users and resources to manage. However, RBAC can also be complex to implement and manage, and may not be appropriate for smaller organizations or environments with lower security requirements.

  • Attribute-Based Access Control (ABAC) grants permissions based on specific attributes or characteristics of a user, resource, or environment. These attributes can include things like job title, location, time of day, and other factors that can be used to determine whether or not access should be granted.

    In an ABAC system, access decisions are made based on policies that define the specific attributes that are required to access a resource. If a user's attributes match the requirements of the policy, access is granted; if not, access is denied.

    Here are some examples of how ABAC can be used in the real world:

    1. A government agency may use ABAC to control access to classified information. Access to the information would be granted only to employees who have the necessary security clearance, based on their job title, location, and other relevant attributes.

    2. An online retailer may use ABAC to control access to customer data. Access to the data would be granted only to employees who have a legitimate business need to access it, based on their job function, department, and other relevant attributes.

    3. A hospital may use ABAC to control access to patient records. Access to the records would be granted only to employees who have a legitimate reason to access them, based on their job function, location, and other relevant attributes.

    ABAC can be a flexible and powerful access control method, and is often used in complex environments where there are many different factors to consider when granting access. However, ABAC can also be complex to implement and manage, and may require specialized tools and expertise to be effective.

• Comparing the access  methods: