In the past two decades (2005-2022) in the USA there has been a sharp increase in data compromise through various malicious processes, one of which unauthorized access certainly is. In the last ten years alone, that number has tripled. The number of recorded cases of data compromise in 2012 was 447, while in the previous year, 1802 cases were recorded. Hacker attacks and data breaches are increasingly common, and because of that it is very important to know how to make software protected from unauthorized access.

In this blog, I will introduce you to Access Control Strategies for implementing fully authorized access to the server. But before we get to that part, let's start with the definition of Access Control.

The Importance of Access Control

What is Access Control?

Access control is a safety-important process in which an application's server validates the user's request to access a specific resource (e.g. bank account balance ) or perform a certain action (e.g. pay for parking). This process involves controlling:

who can access sensitive information or resources;
who can make changes to the system;

Authorization stands as a vital pillar of security, holding significant importance, when embarking on the complex job of projecting a fortified information system. It plays a key role in the meticulous design and implementation of robust security measures, ensuring the utmost protection of invaluable data assets against potential breaches and unauthorized access.

Pros and Cons of Access Control

When designing a software solution, it is important to address the issue of both system security and data security. In this regard, we should take into account the incorporation of authorization, to ensure controlled access to important information (e.g. some private information that could destroy the reputation of the end user).

So, in addition to authorization being the key to the design of secure information systems, it should also provide for high flexibility and scalability, with tailored access control policies adaptable to the organization's growth. Centralized control empowers efficient administration, while accountability boosts through tracking and auditing user actions. Additionally, authorization protects intellectual property, ensures regulations compliance, facilitates secure collaboration, and minimizes human errors that could compromise system integrity.

Aside from the multitude of benefits, authorization also has its drawbacks, which can potentially lead to significant problems. First of all, there is a potential for increased server load, particularly during peak usage, resulting in latency or delays by incorporating additional authentication and authorization processes. Moreover, if authorization is inadequately designed or implemented, it can lead to a misleading perception of security. Lastly, the complexity associated with configuring and managing authorization policies can present difficulties for administrators and developers.

Access Control Strategies

Now that we have explained what Access Control is with all its advantages and disadvantages, we can move on to the authorization strategies available for building a robust and secure information system architecture. Let's see what strategies exist.

Discretionary Access Control (DAC)

In DAC, it is essential to have a resource owner who controls access, determining which users (or groups of users) can access the resource. This ensures that only the users we trust are granted access to the sensitive system information. For example, permissions for access rights can be read, write, or under some special conditions, delete.

There is an interesting example of using this strategy in Linux operating systems. Namely, the Linux file system follows the rules of the DAC strategy, so that each file has an owner. The owner sets permissions in the form `r w x r - x - - -` defined per the file. The first three bits represent the owner permissions (read, write, and execute), the next three bits represent user permissions from the owner’s group (read and execute), and the rest bits represent users permissions from other groups (they do not have any permissions on this resource). The file permissions are configured to grant or restrict access for members within their group or other specific groups.

Mandatory Access Control (MAC)

Contrary to the previous strategy, this strategy enables the system to determine which users or processes can access a resource based on a set of predefined rules. Rules can be created based on the sensitivity of the information that the resource contains and the authorization of the user to access information with that level of sensitivity. MAC is typically used in environments where security is of utmost importance.

Role-Based Access Control (RBAC)

In the end, let’s take a look at one of the most common access control strategies for designing secure informationsystems. The general essence of Role-based access control refers to assigning permissions to users based on their role in the system. This strategy represents a unique case of Attribute-based access control (ABAC) where a user possesses the granted rights to access some resource based on attributes of the user, the resource, and the environment (or system) itself.

During the implementation of RBAC strategy, it is necessary to identify user groups to effectively address user’s needs. In addition to that, permissions should be determined for every defined role. Then one or more roles gets assigned to each user, and based on it, one or more permissions. User-role and role-permission relationships revolutionize user task management by providing a seamless experience. Instead of individually managing each user, this approach grants users privileges that align with the permissions assigned to their roles. As a result, users can effortlessly perform their tasks, benefiting from a streamlined and consistent authorization system.

Implementing access control based on user attributes, and precisely on its roles, offers a straightforward and manageable approach. This method proves superior to assigning permissions individually to users, as it provides a more efficient and streamlined means of managing access control.

The Importance of Access Control

In addition to the above strategies, there are a few more that are not covered in this blog post and will be discussed in one of our next blog posts:

Attributes-based access control,
Policy-based access control,
Rule-based access control,
Risk-based access control, etc.

Summary

Access control is not a one-time task, but an ongoing open challenge to adapt and respond to security-relevant changes in the environment. By setting key priorities and investing in the development of designs and techniques for implementing authorization, software developers, as well as security engineers and system administrators, can contribute to a more secure digital ecosystem for everyone involved.

I hope that I bring you closer to the importance of Access Control and that this blog has been helpful to you. See you on our blog on the next topic!