In the past two decades (2005-2022) in the USA there has been a sharp increase in data compromise through various malicious processes, one of which unauthorized access certainly is. In the last ten years alone, that number has tripled. The number of recorded cases of data compromise in 2012 was 447, while in the previous year, 1802 cases were recorded.

Hacker attacks and data breaches are increasingly common, and because of that it is very important to know how to make software protected from unauthorized access. In this blog, I will introduce you to Access Control Strategies for implementing fully authorized access to the server. But before we get to that part, let's start with the definition of Access Control.

Access control is a safety-important process in which an application's server validates the user's request to access a specific resource (e.g. bank account balance ) or perform a certain action (e.g. pay for parking). This process involves controlling:

• who can access sensitive information or resources; 
• who can make changes to the system;

Authorization stands as a vital pillar of security, holding significant importance, when embarking on the complex job of projecting a fortified information system. It plays a key role in the meticulous design and implementation of robust security measures, ensuring the utmost protection of invaluable data assets against potential breaches and unauthorized access.

When designing a software solution, it is important to address the issue of both system security and data security. In this regard, we should take into account the incorporation of authorization, to ensure controlled access to important information (e.g. some private information that could destroy the reputation of the end user).

So, in addition to authorization being the key to the design of secure information systems, it should also provide for high flexibility and scalability, with tailored access control policies adaptable to the organization's growth. Centralized control empowers efficient administration, while accountability boosts through tracking and auditing user actions. Additionally, authorization protects intellectual property, ensures regulations compliance, facilitates secure collaboration, and minimizes human errors that could compromise system integrity.

Aside from the multitude of benefits, authorization also has its drawbacks, which can potentially lead to significant problems. First of all, there is a potential for increased server load, particularly during peak usage, resulting in latency or delays by incorporating additional authentication and authorization processes. Moreover, if authorization is inadequately designed or implemented, it can lead to a misleading perception of security. Lastly, the complexity associated with configuring and managing authorization policies can present difficulties for administrators and developers.

Now that we have explained what Access Control is with all its advantages and disadvantages, we can move on to the authorization strategies available for building a robust and secure information system architecture. Let's see what strategies exist.

In DAC,** it is essential to have a resource owner who controls access**, determining which users (or groups of users) can access the resource. This ensures that only the users we trust are granted access to the sensitive system information. For example, permissions for access rights can be read, write, or under some special conditions, delete.

There is an interesting example of using this strategy in Linux operating systems. Namely, the Linux file system follows the rules of the DAC strategy, so that each file has an owner. The owner sets permissions in the form

r w x r - x - - -

Contrary to the previous strategy, this strategy enables the system to determine which users or processes can access a resource based on a set of predefined rules. Rules can be created based on the sensitivity of the information that the resource contains and the authorization of the user to access information with that level of sensitivity. MAC is typically used in environments where security is of utmost importance.

In the end, let’s take a look at one of the most common access control strategies for designing secure information systems. The general essence of Role-based access control refers to assigning permissions to users based on their role in the system. This strategy represents a unique case of Attribute-based access control (ABAC) where a user possesses the granted rights to access some resource based on attributes of the user, the resource, and the environment (or system) itself. 

During the implementation of RBAC strategy, it is necessary to identify user groups to effectively address user’s needs. In addition to that, permissions should be determined for every defined role. Then one or more roles gets assigned to each user, and based on it, one or more permissions. User-role and role-permission relationships revolutionize user task management by providing a seamless experience. Instead of individually managing each user, this approach grants users privileges that align with the permissions assigned to their roles. As a result, users can effortlessly perform their tasks, benefiting from a streamlined and consistent authorization system.

Implementing access control based on user attributes, and precisely on its roles, offers a straightforward and manageable approach. This method proves superior to assigning permissions individually to users, as it provides a more efficient and streamlined means of managing access control.

In addition to the above strategies, there are a few more that are not covered in this blog post and will be discussed in one of our next blog posts:

• Attributes-based access control,
• Policy-based access control,
• Rule-based access control,
• Risk-based access control, etc.

Access control is not a one-time task, but an ongoing open challenge to adapt and respond to security-relevant changes in the environment. By setting key priorities and investing in the development of designs and techniques for implementing authorization, software developers, as well as security engineers and system administrators, can contribute to a more secure digital ecosystem for everyone involved.

I hope that I bring you closer to the importance of Access Control and that this blog has been helpful to you. See you on our blog on the next topic!