Concept - Access Control
Definition: “The prevention of unauthorized use of a resource, including the prevention of use of a resource in an unauthorized manner” (s.2). A central element of computer security.
- Assumes users and groups who authenticate to the system and are assigned access rights to certain resources (s.2).
- Flow (s.3): user authentication function access control function (consults the authorization database, managed by the security administrator) system resources; auditing watches the whole path.
- A policy “embodied in an authorization database” dictates what access is permitted, under what circumstances, and by whom (s.4).
Added context
Your Chapter 4 class note says this chapter covers authorization, one of the extra “A”s next to authentication, availability and accountability in your Chapter 1 notes. Not stated on the slides.
Related: Concept - Discretionary Access Control, Concept - Mandatory Access Control, Concept - Role-Based Access Control, Concept - User Authentication, Concept - Access Control Function. Appears in 04 Access Control - Chunk 01 (s.1-28).