Access Control

Access Control

Access control is the process of controlling who or what can access
systems, applications, networks, files, databases, and other
resources.

A secure organization should not allow every user to access every
resource. Access should be granted according to legitimate business
requirements and should be limited to the minimum level required.

1. Why Access Control Matters

Access control is one of the foundations of cybersecurity.
Poorly controlled access can allow attackers or unauthorized users
to view, modify, delete, or misuse sensitive information.

Strong access control helps protect:

• Confidential information.
• Customer records.
• Financial data.
• Business applications.
• Servers and network devices.
• Databases.
• Cloud services.
• Administrative systems.

2. The Four Basic Access Concepts

Access control is often explained using four important concepts:
identification, authentication, authorization, and accountability.

Identification

Identification is the process of claiming an identity.
For example, a user enters a username or email address.

Authentication

Authentication verifies that the claimed identity is genuine.

Authorization

Authorization determines what an authenticated user is allowed to
access or perform.

Accountability

Accountability connects actions to identities through appropriate
logging and monitoring.

3. Authentication vs Authorization

Authentication and authorization are related but different.

• Authentication: Who are you?
• Authorization: What are you allowed to do?

For example, a user may successfully log in to an application but
still be prohibited from accessing administrative settings.

4. Authentication Factors

Authentication can use different categories of evidence.

Something you know

• Password.
• PIN.
• Passphrase.

Something you have

• Security token.
• Authenticator device.
• Smart card.

Something you are

• Fingerprint.
• Facial characteristics.
• Other biometric characteristics.

Using multiple independent authentication factors can provide
stronger protection than relying on a password alone.

5. Multi-Factor Authentication

Multi-factor authentication, commonly called MFA, requires more than
one authentication factor.

For example, an organization might require a password together with
an authenticator application or hardware security key.

MFA can reduce the impact of stolen passwords because an attacker
may still require the additional authentication factor.

6. Strong Authentication Practices

• Use strong and unique passwords.
• Enable MFA for important accounts.
• Protect administrator accounts.
• Avoid sharing credentials.
• Monitor suspicious authentication activity.
• Disable unnecessary authentication methods.
• Protect recovery mechanisms.

7. Principle of Least Privilege

The principle of least privilege means that users, applications,
devices, and services should receive only the permissions necessary
to perform their legitimate tasks.

For example, an employee who only needs to read customer records
should not automatically receive permission to delete the entire
database.

Least privilege limits the potential damage caused by compromised
accounts and mistakes.

8. Why Least Privilege Matters

If an attacker compromises an account with excessive privileges, the
attacker may be able to perform far more harmful actions.

Reducing permissions can therefore reduce the potential impact of
account compromise.

Least privilege should apply to:

• Users.
• Administrators.
• Applications.
• Servers.
• Databases.
• Cloud services.
• Automation accounts.

9. Role-Based Access Control

Role-Based Access Control, or RBAC, assigns permissions according to
defined organizational roles.

Example roles include:

• Student.
• Instructor.
• Content Editor.
• Finance Officer.
• System Administrator.
• Security Administrator.

Instead of manually assigning dozens of permissions to every user,
administrators can assign users to appropriate roles.

10. Example of RBAC

The exact permissions should always be based on real organizational
requirements.

11. Privileged Accounts

A privileged account has elevated permissions that allow the user to
perform sensitive administrative actions.

Examples include:

• System administrator accounts.
• Database administrator accounts.
• Cloud administrator accounts.
• Network administrator accounts.
• Security administrator accounts.

Because privileged accounts can cause significant impact when
compromised, they require stronger security controls.

12. Protecting Privileged Accounts

• Use MFA.
• Use separate administrative accounts.
• Avoid using administrator accounts for ordinary tasks.
• Monitor privileged activity.
• Review permissions regularly.
• Use strong authentication.
• Remove unnecessary privileges.

13. Separate Administrative Accounts

An administrator should ideally have a normal account for ordinary
activities and a separate privileged account for administrative
tasks.

This reduces the amount of time that powerful credentials are exposed
during routine activities such as browsing websites or reading
ordinary email.

14. Account Provisioning

Provisioning is the process of creating and configuring access for a
new user.

A secure provisioning process should:

1. Confirm the user’s identity.
2. Confirm the user’s role.
3. Determine required permissions.
4. Create the appropriate account.
5. Enable required authentication controls.
6. Document the access granted.

15. Account Deprovisioning

Deprovisioning is the process of removing access when it is no longer
required.

This is especially important when an employee leaves an organization
or changes responsibilities.

Deprovisioning may involve:

• Disabling the account.
• Revoking sessions.
• Removing group membership.
• Removing application access.
• Revoking tokens.
• Recovering organizational devices.

16. The Joiner, Mover, Leaver Process

A strong identity management process considers three common events:

• Joiner: A new employee or user joins the organization.
• Mover: An existing user changes role or responsibility.
• Leaver: A user leaves the organization.

Each event can require access changes.

One of the major risks is failing to remove old permissions when a
user changes roles.

17. Access Reviews

Access reviews are periodic checks of user permissions.

The purpose is to identify:

• Unused accounts.
• Excessive permissions.
• Incorrect role assignments.
• Former employees with active access.
• Users with unnecessary administrative privileges.

Access reviews should be documented and performed according to the
organization’s risk level.

18. Account Lifecycle

A secure account lifecycle should include:

1. Request.
2. Approval.
3. Creation.
4. Authentication setup.
5. Role assignment.
6. Monitoring.
7. Periodic review.
8. Modification when responsibilities change.
9. Deactivation when access is no longer needed.

19. Access Control Lists

An Access Control List, or ACL, is a set of rules that defines which
users, groups, or systems can perform certain actions on a resource.

ACLs can be used with files, directories, applications, network
resources, and other systems.

Typical permissions include:

• Read.
• Write.
• Modify.
• Delete.
• Execute.

20. File and Folder Permissions

File permissions determine who can interact with files and
directories.

A secure configuration should prevent ordinary users from modifying
files that they do not need to change.

Sensitive configuration files should receive particularly careful
permission management.

21. Database Access Control

Database accounts should receive only the permissions required by the
applications or administrators using them.

For example, an application that only reads data should not
automatically receive permission to delete tables.

Separate database accounts for different applications and
responsibilities can improve accountability and reduce risk.

22. Application Authorization

Applications should enforce authorization on the server side.

A user interface should not be treated as the only security control.
Hiding an administrator button does not prevent a user from
attempting to access the underlying functionality directly.

The server should verify permissions whenever a sensitive operation
is requested.

23. Authentication and Session Security

Access control also depends on secure sessions.

Applications should consider:

• Secure authentication.
• Session expiration.
• Secure session handling.
• Protection against session theft.
• Logout mechanisms.
• Reauthentication for sensitive actions.

24. Access Control and Logging

Important access events should be logged and monitored.

Examples include:

• Successful administrative login.
• Failed authentication attempts.
• Privilege changes.
• New account creation.
• Account deletion.
• Permission changes.
• Sensitive data access.

Logs should avoid exposing passwords, authentication secrets, or
other unnecessary sensitive information.

25. Temporary Access

Some users may need elevated access only for a limited period.

Temporary access should have:

• A defined purpose.
• An approved owner.
• A defined expiration time.
• Appropriate monitoring.
• Automatic or manual removal after the task.

Temporary access that never expires can become permanent excessive
privilege.

26. Service Accounts

Service accounts are accounts used by applications, services, or
automated processes.

They should be treated carefully because they may have long-running
access to important systems.

Good practices include:

• Use dedicated accounts.
• Grant minimum required permissions.
• Protect credentials.
• Monitor usage.
• Review permissions.
• Remove unused accounts.

27. Access Control in Cloud Environments

Cloud platforms provide detailed identity and access management
systems.

Cloud access should follow the same security principles:
least privilege, strong authentication, role separation, logging,
monitoring, and regular review.

A cloud administrator account should receive special protection
because compromise can affect many resources at once.

28. Zero Trust and Access Control

Zero Trust is a security approach based on the principle that access
should not automatically be trusted simply because a user or device
is inside a particular network.

Access decisions can consider:

• User identity.
• Device security.
• Application.
• Location or network context.
• Requested resource.
• Risk level.

The exact implementation depends on the organization’s environment.

29. Common Access Control Weaknesses

• Shared user accounts.
• Weak passwords.
• No MFA for administrators.
• Excessive privileges.
• Unused accounts.
• Former employees retaining access.
• Uncontrolled service accounts.
• Unreviewed permissions.
• Shared administrator credentials.
• Insufficient access logging.

30. Defensive Access Control Example

The following PHP example demonstrates a simple defensive
authorization check before allowing an administrative action.

<?php

if ( ! current_user_can( 'manage_options' ) ) {

	wp_die(
		'You do not have permission to perform this action.'
	);
}

/*
 * Continue with the authorized
 * administrative operation.
 */

The important security principle is that authorization should be
verified before performing a sensitive operation.

31. Access Control Policy Example

A basic organizational access control policy could state:

• Every user must have an individual account.
• Account sharing is prohibited.
• MFA is required for privileged accounts.
• Permissions must follow least privilege.
• Administrative access must be approved.
• User access must be reviewed periodically.
• Inactive accounts must be disabled.
• Former employees must have access removed promptly.
• Privileged activity must be logged.

32. Practical Example

Consider a training organization with students, instructors,
administrators, and finance staff.

A student should be able to access learning materials and their own
learning records, but should not be able to modify another student’s
account.

An instructor may need access to course content and student
assignments, while a finance staff member may need access to payment
records but not technical administration.

An administrator may require broader access, but administrative
permissions should still be limited to legitimate responsibilities.

33. Access Control Review Exercise

34. Practical Lab

Scenario

A company discovers that several employees have permissions that are
not required for their current jobs. One former employee also has an
active account.

Your tasks

1. Identify the access control weaknesses.
2. Explain how least privilege should be applied.
3. Describe how the former employee’s access should be handled.
4. Recommend a process for reviewing permissions.
5. Identify which accounts should receive MFA.
6. Explain how privileged activity should be monitored.
7. Create a simple RBAC model for three organizational roles.

35. Knowledge Check

1. What is access control?
2. What is the difference between authentication and authorization?
3. What is least privilege?
4. What is RBAC?
5. Why are privileged accounts important?
6. What is account deprovisioning?
7. Why should organizations conduct access reviews?
8. Why should users have individual accounts?
9. What is the purpose of MFA?
10. Why should authorization be checked on the server?

36. Key Terms

• Access Control: The process of controlling access to resources.
• Authentication: Verification of an identity.
• Authorization: Determination of permitted actions.
• Least Privilege: Giving only the minimum permissions required.
• RBAC: Role-Based Access Control.
• MFA: Multi-Factor Authentication.
• Privileged Account: An account with elevated permissions.
• Provisioning: Creating and configuring access.
• Deprovisioning: Removing access when it is no longer required.
• ACL: Access Control List defining permissions for a resource.

37. Summary

Access control protects systems and information by controlling who
can access resources and what actions they can perform.

Strong access control begins with proper identification,
authentication, authorization, and accountability.

Organizations should apply least privilege, use role-based access
where appropriate, protect privileged accounts, enable strong
authentication, review permissions regularly, and remove access
when it is no longer required.

Access control is not a one-time configuration. It is a continuous
process that must adapt as users, applications, systems, and business
requirements change.

Next Lesson

Module 6 — Lesson 7: Endpoint Security

In the next lesson, we will examine endpoint security, endpoint
protection, malware prevention, device hardening, patch management,
host firewalls, endpoint monitoring, removable media, and secure
device management.