Access Control Models
IAAA
Access control follows four steps: identification (who you claim to be), authentication (proving it), authorization (what you may do), and accountability (logging what you did). Every access control technology maps to one of these steps.
Authentication factors
- Something you know — password, PIN, passphrase.
- Something you have — token, smart card, phone.
- Something you are — biometric.
- Multifactor means factors from different categories; two passwords is not multifactor.
Biometric systems are tuned with the false rejection rate (FRR, Type I error) and the false acceptance rate (FAR, Type II error). The crossover error rate (CER) — where the two are equal — is the standard measure of accuracy; a lower CER means a better system. Type II errors are the more dangerous because an impostor is admitted.
Access control models
- DAC — the data owner decides; implemented with ACLs. Flexible, common in commercial OSes, vulnerable to malware acting as the user.
- MAC — the system enforces labels and clearances; used in classified environments. Rigid but strong.
- RBAC — access follows job role; best for organizations with high turnover.
- ABAC — decisions use attributes of subject, object, action, and environment (time, location).
- Rule-based — 'if/then' rules applied to everyone, such as a firewall ruleset.
Exam tip
Provisioning and, more importantly, deprovisioning must be tied to HR processes. Orphaned accounts and privilege creep from job changes are two of the most common audit findings.