Scribd
Upload
19 views

Aswin TS Access Control Simplified Notes Unit 3 Dist Sys

Uploaded by

tejeswarkomara
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
19 views

Aswin TS Access Control Simplified Notes Unit 3 Dist Sys

Uploaded by

tejeswarkomara
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 4

What is Access Control?

Access control is a system that decides who can use a resource, what they can do with
it, and under what conditions. For example, a company may allow an employee to access
their work computer only during office hours.

To enforce access control, three key steps are involved:

1. Identification: Finding out who the user is (e.g., entering a username).


2. Authentication: Confirming that the user is who they claim to be (e.g., by entering
a correct password or scanning their fingerprint).
3. Authorization: Deciding what the user is allowed to do (e.g., view, edit, or delete
a file).

Authentication Factors

Authentication is the process of proving your identity, and it is done using:

1. Something You Know: Like a password or PIN.

Example: Logging into your email with a password.

2. Something You Have: Like a smart card or an OTP (One-Time Password).

Example: Receiving a security code on your phone.

3. Something You Are: Unique personal features like fingerprints or facial


recognition.

Example: Using Face ID to unlock your phone.

Multi-Factor Authentication (MFA):

This means using two or more of the above methods together. For instance, you might log
in with a password (something you know) and a fingerprint (something you are) for extra
security.

Types of Access Control Models

Access control works using different models. Each model has its own way of deciding
who gets access:

1. Attribute-Based Access Control (ABAC):

Access depends on certain attributes or conditions.


For example:

Allowing access only if the user is part of the “Sales Team” and the request is during
working hours.

2. Discretionary Access Control (DAC):

The owner of the resource (like a file) decides who gets access.

Example: A document’s creator shares it only with specific colleagues.

3. Mandatory Access Control (MAC):

Access is controlled by strict rules set by a central authority

Example: Only employees with “Top Secret Clearance” can access certain files.

4. Role-Based Access Control (RBAC):

Access is given based on job roles.

Example: A manager can view and edit employee records, but a regular employee
cannot.

5. Rule-Based Access Control (RAC):

Access depends on predefined rules or conditions.

Example: Students can access a school lab only from 9 AM to 5 PM.

6. History-Based Access Control (HBAC):

Access is decided by analyzing the user’s previous actions or behavior.

Example: Blocking access if unusual activity is detected, like logging in from a new
country.

7. Identity-Based Access Control (IBAC):

Access is tied to individual identities.

Example: Assigning custom permissions to a user based on their specific needs.


8. Organization-Based Access Control (OrBAC):

Access policies are set for the organization as a whole, without focusing on individuals.

Example: A company-wide rule that all employees can access the intranet.

Types of Access Control

Access control can be applied in two main ways:

1. Physical Access Control:

Controls entry to physical locations like buildings or server rooms.

Example: Employees scan ID cards to enter the office.

2. Logical Access Control:

Controls who can use digital systems like computers, files, or networks.

Example: Requiring a password to log into your laptop.

Challenges in Access Control

Implementing access control can face difficulties:

1. Managing Distributed Systems:

Today’s IT systems often combine cloud services with on-site networks, making it harder
to control access consistently

2. Creating and Applying Policies:

Organizations must write clear policies, and IT teams must convert these into working
systems. Coordination is essential.
3. Monitoring and Reporting:

Regularly checking logs helps detect unusual activity and ensures compliance with rules.

How Access Control Works

Step 1: A user tries to log in by providing their credentials (like a password or


fingerprint).
Step 2: The system checks if the credentials are correct. If they are valid, the user
is authenticated.
Step 3: The system looks at the user’s permissions to decide what they can do.

For extra security, many systems use multi-factor authentication to verify users in more
than one way.

You might also like