Access Control
Access Control tests how identities are proven, authorized, and held accountable when they touch systems and data. Expect questions on models, lifecycle, and the difference between authentication and authorization.
Core rules
- AAA: identification claims an identity; authentication verifies it; authorization decides permitted actions; accountability comes from logging and attribution.
- DAC lets the resource owner set access. MAC uses system-enforced labels and clearances. RBAC grants through roles. ABAC evaluates attributes such as department, device, and time.
- Least privilege, need-to-know, separation of duties, and dual control reduce insider and error risk.
- Identity lifecycle: request, approve, provision, review, modify, deprovision. Timely revocation matters more than elegant onboarding.
- Federation and SSO rely on trust; SAML assertions and OIDC tokens must be validated for issuer, audience, signature, and expiry.
Worked example
A finance clerk needs to approve payments only up to $10,000. A DAC share would let a file owner over-grant. A single finance role may be too broad. An ABAC rule can require department=finance, amount<=10000, and device=managed. The decision is logged with the user, resource, action, and policy result, so access is least-privilege and auditable.
Traps
Authentication does not imply authorization. MAC is not mandatory password; it is label-based. RBAC assigns permissions to roles, not users directly. Access reviews that only confirm accounts exist miss excessive entitlements. Shared accounts destroy accountability.