Access Control

Access control is a security mechanism that regulates who can view or use resources in a computing environment, ensuring only authorized users can access systems and data.

Access control is a fundamental security concept that restricts access to systems, data, and resources based on policies that determine who or what is allowed to access, under what conditions, and what actions they can perform.

Common access control models include: - RBAC (Role-Based Access Control): Access based on user roles (admin, developer, viewer) - ABAC (Attribute-Based Access Control): Access based on attributes (department, location, time) - DAC (Discretionary Access Control): Resource owners control access to their resources - MAC (Mandatory Access Control): System-enforced policies based on classification levels

Key access control principles: - Least Privilege: Users get minimum permissions needed - Separation of Duties: Critical functions split across multiple users - Need-to-Know: Access limited to information required for job function

Access control is evaluated through regular access reviews, typically quarterly or annually, to ensure permissions remain appropriate.

Why It Matters

Without proper access control, organizations face unauthorized data exposure, regulatory penalties, and breach liability. Every major compliance framework—from SOC 2 to HIPAA—requires documented access controls. Implementing role-based access with regular reviews is one of the most impactful security investments an organization can make, reducing insider threat risk by up to 80% and dramatically simplifying audit evidence collection.

Key Points

Core requirement of every compliance framework

Implements principle of least privilege

RBAC is most common model for modern applications

Requires regular access reviews (quarterly/annually)

Must include both authentication and authorization

Applicable Compliance Frameworks

SOC 2 ISO 27001 HIPAA PCI DSS GDPR

Related Terms

Multi-Factor Authentication (MFA)

MFA is a security mechanism requiring users to provide two or more verification factors to gain access, significantly reducing the risk of unauthorized access.

Least Privilege

The principle of least privilege grants users only the minimum permissions necessary to perform their job functions, reducing security risk.