Domain 3: Access Control Concepts
Principles
- Least privilege: give users only the access they need.
- Need to know: access only to information required for a task.
- Separation of duties: no single person controls a whole critical process.
- Defense in depth: multiple layers of controls.
Access control models
| Model | Who decides | Example |
|---|---|---|
| DAC (discretionary) | the owner of the object | file permissions on a personal PC |
| MAC (mandatory) | the system, based on labels and clearances | military classification |
| RBAC (role-based) | permissions attached to roles | HR role can read payroll |
| ABAC (attribute-based) | rules over attributes | allow if department=finance and time=office hours |
Authentication factors
Something you know (password), something you have (token, smart card), something you are (biometrics). Multi-factor authentication uses two or more different factors.
Physical access controls
Badges, mantraps, turnstiles, bollards, guards, and CCTV. Monitoring with logs and alarms.