Dictionary · Defensive Security
Access Control
Design · Beginner
The policies and mechanisms that decide which identities may use which resources, and what they may do with them.
It includes the policy and the enforcement. Roles, permissions, and firewall rules are all forms of it. The useful test is what a normal account cannot do.
Example: Only the finance role can open the payroll share, and the file server enforces that rule rather than trusting each user to behave.
Common misconception
- A written policy that nobody enforces is not access control. Enforcement is part of the term.