# Logical Access Controls

> Chapter 8 of the Courseiva ISC2-CC curriculum — https://courseiva.com/learn/isc2-cc/logical-access-controls

**Official objective:** 2.3 — Understand logical access control methods, including passwords, tokens, certificates, and access control lists.

## Introduction

Domain 2 of the ISC2 Certified in Cybersecurity exam focuses on access controls. Logical access controls are the invisible gatekeepers that decide who gets into your computer, network, or cloud account — and what they can do once inside. For someone studying CC, understanding them is crucial because the exam will test how these controls work together to prevent unauthorised access.

## The Club Bouncer Analogy

Why does the bouncer at a nightclub check your ID, scan a ticket, and then glance at a list on their phone before letting you in?

Because the club has three layers of logical access controls, and each one serves a different purpose. First, your ticket is like a **password** — something you have that proves you were allowed in. But anyone could steal that ticket. So the bouncer also checks your photo ID — that is a **token** (something you physically possess). Finally, the bouncer consults a high-tech list: the **access control list**. This list says exactly who is allowed on the VIP floor, who can use the side entrance, and who gets turned away after midnight.

In the IT world, the club is a computer system. The bouncer is the operating system's security monitor. The ticket is your password, the photo ID is a hardware token or certificate, and the list is the access control list (ACL). You have to present all three — or at least some combination — to get through. And the bouncer never trusts anyone just because they have a friendly face. That is the principle of "never trust, always verify."

## Core explanation

Logical access controls are the digital rules and mechanisms that decide who can access a resource (like a file, a server, or a network) and what they can do with it. They are called "logical" because they are implemented in software and operating systems, not in physical locks or guards. They are the brains behind the computer's security.

Let's break down the main types you need to know for the CC exam.

**Passwords** are the most common logical access control. A password is a secret string of characters that you provide to prove you are who you claim to be. The problem with passwords is that they can be guessed, stolen, or forgotten. That is why modern systems enforce password policies: minimum length, complexity (mixing letters, numbers, and symbols), and expiry. The CC exam will ask you to identify best practices for password management, such as never sharing passwords and using different passwords for different accounts.

**Tokens** are physical devices or software applications that generate a one-time code. A token is something you have. The classic example is a key fob that displays a six-digit number that changes every 30 seconds. You enter this number along with your password to log in. This is called multi-factor authentication (MFA). Tokens are harder to steal than passwords because they are physical objects. However, they can be lost or stolen. The exam will test that tokens provide "something you have" factor in authentication.

**Certificates** are digital files that work like an electronic passport. A certificate proves the identity of a user, computer, or device. It contains a public key and information about the owner. Certificates are issued by a trusted authority called a Certificate Authority (CA). When you visit a secure website (HTTPS), the website sends a certificate to your browser, which checks it against a list of trusted CAs. If it matches, your browser trusts the site. In the CC exam, you need to know that certificates are used for authentication and encryption, and that they rely on a chain of trust.

**Access Control Lists (ACLs)** are rules that define what each user or group can do with a resource. Think of an ACL as a spreadsheet with columns: username, resource, and permission (read, write, execute, delete). For example, an ACL on a file might say: "Alice can read and write; Bob can only read; Carol has no access." Operating systems like Windows and Linux use ACLs to enforce file permissions. Network routers also use ACLs to control which traffic is allowed through. The CC exam will test that ACLs are a method of implementing the principle of least privilege (giving users only the minimum permissions they need to do their job).

Together, these four methods form the core of logical access control. The goal is to protect confidentiality (keeping data secret), integrity (preventing unauthorised changes), and availability (ensuring authorised users can access resources when needed). The CC exam will expect you to recognise each method, understand how they differ, and know when to use each one.

A key concept tied to logical access controls is the **AAA framework**: Authentication, Authorisation, and Accounting. Authentication is proving who you are (e.g., with a password). Authorisation is determining what you are allowed to do (e.g., with an ACL). Accounting is logging what you did (e.g., audit trails). The CC exam often asks which control belongs to which step of AAA.

Finally, remember that no single control is perfect. Security experts use a layered approach called "defence in depth," combining passwords, tokens, certificates, and ACLs to create multiple barriers. The CC exam will present scenarios where a single control has failed, and you must choose the best additional control to add.

## Real-world context

Imagine you are an IT support technician at a medium-sized company. A new employee, Priya, starts today. She needs access to the company's financial software, shared drive, and email. What do you do, step by step?

**Step 1: Create an account with a strong password.** You open the user administration tool. You create a username (priya.sharma) and generate a temporary complex password (e.g., P@ssw0rd!23). The system enforces a policy: minimum 12 characters, must include uppercase, lowercase, number, and special character. You also enable password expiry — she will need to change it on first login. The CC exam would test that passwords are the first line of defence but are vulnerable to brute-force attacks.

**Step 2: Issue a hardware token for MFA.** The company uses a physical token fob for the financial application. You give Priya the fob and register its serial number in the system. Now, to access the financial software, she must enter her password plus the current six-digit code from the fob. This is "something you know" (password) plus "something you have" (token). The exam might ask: what type of attack does this prevent? Answer: credential theft (even if her password is stolen, the attacker needs the physical token).

**Step 3: Assign a digital certificate for device authentication.** Priya's laptop needs to connect to the internal network. You install a digital certificate on her laptop, issued by the company's internal Certificate Authority. This certificate proves that her laptop is a trusted company device, not a personal one. When she connects to Wi-Fi, the network checks the certificate before granting access. The CC exam tests that certificates establish identity and trust, and that they are used in protocols like TLS/SSL.

**Step 4: Configure access control lists (ACLs).** The finance folder on the server has an ACL. You add Priya's username to the ACL with "read" and "write" permissions. The shared drive has a different ACL — she gets "read" only to the marketing folder and "read/write" to the project folder. The HR folder is not in her ACL at all, so she cannot see it. The exam loves to ask: what principle does this enforce? Answer: the principle of least privilege.

**Step 5: Log and monitor.** The system logs every time Priya logs in, accesses a file, or changes a password. This is the "Accounting" part of AAA. You as the IT admin can later review these logs if a security incident occurs. The CC exam might present a scenario where an unauthorised access attempt is detected via logs, and ask what control should be strengthened.

In practice, an IT professional would also schedule periodic reviews of ACLs — revoking access for employees who leave or change roles. They would also renew certificates before they expire and reset passwords when users forget them. The entire process is about balancing security with usability: too many controls frustrate users; too few invite breaches.

For the CC exam, remember that real-world implementations often combine all four methods. A question might list a scenario and ask which additional control is most appropriate. For example: "A company uses passwords only. What should they add?" The answer is a token for MFA.

## Exam focus

The ISC2 CC exam test domain 2.3 specifically on logical access controls. Here is exactly what you need to know.

**Exam Question Types:**
- Multiple-choice questions asking you to identify which control matches a description.
- Scenario-based questions: you are given a real-world situation (e.g., a company wants to allow read-only access to a file for a group of users) and you must pick the correct control (in this case, an ACL).
- Definition questions: "Which term describes something you have?" Answer: token.
- Comparison questions: "What is the difference between a certificate and a token?"

**Trap Patterns to Watch For:**
- The exam might describe a control that sounds like a password but actually refers to a token. For example: "A user enters a code from a key fob." This is a token, not a password.
- They might ask about an ACL in a networking context. If they mention a router filtering traffic based on IP addresses, that is an ACL.
- They may confuse certificates with encryption. Remember: certificates are primarily for identity proof, not encryption itself (though they enable encryption).
- A common trap: they describe multi-factor authentication and list two passwords as the factors. That is wrong — two passwords are still just one factor (something you know). The factors must be from different categories: something you know, something you have, something you are.

**Concepts the CC Exam Loves to Test:**
- **The three factors of authentication:** knowledge (password), possession (token), inherence (biometrics). Know them.
- **The principle of least privilege:** always grant the minimum access needed.
- **Defence in depth:** multiple layers of controls.
- **AAA:** Authentication, Authorisation, Accounting. You must be able to map each control to the correct A.
- **ACL versus capability list:** ACL lists who can access a resource; capability list lists what resources a user can access. The CC exam may ask you to distinguish them.
- **Certificate chain of trust:** certificates are issued by a Certificate Authority (CA). The browser trusts the CA, so it trusts the certificate.
- **Password policies:** length, complexity, expiry, history (preventing reuse).

**Key Definitions to Memorise for the Exam:**
- Password: a secret string of characters (knowledge factor).
- Token: a physical or software device that generates a one-time code (possession factor).
- Certificate: a digital file issued by a CA that proves identity (used for authentication and encryption).
- Access Control List (ACL): a list of permissions attached to an object that specifies which users or groups have what type of access.

The exam will also test your ability to apply these concepts in a security incident scenario. For instance, if a user's token is stolen, what should be done? Answer: revoke the token and issue a new one. If a certificate expires, what happens? Access is denied until it is renewed.

Finally, the exam might ask about the difference between logical and physical access controls. Logical controls are software-based (passwords, ACLs). Physical controls are tangible (locks, guards, biometric readers). Do not mix them up.

## Step by step

1. **Identify the Resource** — First, you determine exactly what you are protecting. It could be a file, a network share, a database, a cloud storage bucket, or a physical server. The resource type influences which logical access control is appropriate. For example, a file on a server typically uses an access control list (ACL), while a cloud API might use a certificate. This step is crucial because different resources have different security models.
2. **Select an Authentication Method** — You choose how the user will prove their identity. This could be a password (knowledge factor), a hardware token (possession factor), or a biometric scan (inherence factor). Often you combine two methods for multi-factor authentication. The CC exam tests that authentication is the first step in the AAA framework. Without proper authentication, authorisation and accounting are meaningless.
3. **Issue or Configure the Credential** — Now you set up the actual credential. For a password, you create the account and set an initial password. For a token, you register the device serial number in the system. For a certificate, you generate a key pair and get it signed by a Certificate Authority. This step ensures the credential is bound to the correct user and stored securely. Misconfiguration here leads to vulnerabilities like weak passwords or expired certificates.
4. **Define Permissions via an Access Control List** — You create or update the ACL for the resource. You specify which users or groups get what level of access: read, write, execute, or delete. For example, for a financial document, you might give the finance team read-write access and auditors read-only access. This step enforces the principle of least privilege. The CC exam often asks about the relationship between ACLs and permissions.
5. **Enforce and Monitor Access** — Finally, the system enforces the rules you set. When the user attempts to access the resource, the system checks the ACL and the authentication status. All successful and failed attempts are logged (accounting). An IT admin would regularly review these logs for anomalies, such as repeated failed password attempts, which might indicate a brute-force attack. This step closes the loop in the AAA framework.
6. **Review and Revoke Access Periodically** — Logical access controls are not set-and-forget. Employees change roles or leave the company. Certificates expire. Tokens get lost. You must periodically review who has access and remove unnecessary permissions. For example, if a developer moves to a marketing role, you remove their write access to the code repository. This step is critical for maintaining security over time and is often tested in scenario questions.

## Comparisons

### Password vs Token

**Password:**
- Something you know
- Can be guessed or stolen easily
- Does not require physical hardware

**Token:**
- Something you have
- Harder to steal (physical device)
- Requires a physical token or app

### Certificate vs Token

**Certificate:**
- Digital file proving identity
- Issued by a Certificate Authority
- Used for both authentication and encryption

**Token:**
- Physical or software device generating codes
- Does not require a CA
- Used only for authentication, not encryption

### Access Control List (ACL) vs Firewall Rule

**Access Control List (ACL):**
- Defines permissions for users/groups on a resource
- Can be applied to files, folders, or network devices
- Focuses on who can access what

**Firewall Rule:**
- Filters network traffic based on IP/port
- Applied only on network devices (routers, firewalls)
- Focuses on which traffic is allowed/blocked

### Multi-Factor Authentication (MFA) vs Single-Factor Authentication

**Multi-Factor Authentication (MFA):**
- Uses two or more different factor categories
- Provides stronger security
- Requires more effort to bypass

**Single-Factor Authentication:**
- Uses only one factor (e.g., password)
- Easier for users
- More vulnerable to theft or guessing

### Authentication vs Authorisation

**Authentication:**
- Verifies who you are
- Happens first in the AAA framework
- Examples: entering a password, swiping a token

**Authorisation:**
- Determines what you can do
- Happens after authentication
- Examples: ACL checking permissions

## Diagram

_This flowchart shows how a user goes through authentication (using password, token, biometric, or certificate) and then authorisation (via an ACL check) before access is granted or denied, with all actions logged._

```mermaid
flowchart TD
    A[User] --> B{Authentication?}
    B -->|Password| C[Knowledge Factor]
    B -->|Token| D[Possession Factor]
    B -->|Biometric| E[Inherence Factor]
    B -->|Certificate| F[Identity Proof]
    C & D & E & F --> G{Authorisation?}
    G -->|ACL Check| H[Access Granted]
    G -->|ACL Denies| I[Access Denied]
    H --> J[Accounting Log Created]
    I --> J
```

## Common misconceptions

- **Misconception:** Passwords and tokens do the same thing — they both prove who you are. **Reality:** Passwords are something you know; tokens are something you have. They are different factors of authentication. Using both together provides stronger security than using either alone. (Beginners often lump all authentication methods together because they all involve entering something. The exam tests the distinct categories.)
- **Misconception:** An access control list (ACL) is the same as a firewall. **Reality:** An ACL is a set of rules that defines permissions for users or network traffic. A firewall is a device that filters traffic based on ACLs, but an ACL can also be used in operating systems to control file access. They are not interchangeable. (The terms are often used loosely in everyday IT, but the CC exam expects precise definitions.)
- **Misconception:** Certificates are only used for websites (HTTPS). **Reality:** Certificates are used for many purposes, including securing email, authenticating devices on a network, signing software, and encrypting data in transit. HTTPS is just one common application. (Beginners typically encounter certificates only in their browser's address bar, so they assume that is the only use case.)
- **Misconception:** Multi-factor authentication (MFA) means using two passwords. **Reality:** MFA requires factors from different categories. Using two passwords is still just one factor (knowledge). True MFA combines, for example, a password and a token (knowledge + possession) or a password and a fingerprint (knowledge + inherence). (The word 'multi' can confuse people into thinking any two things count. The CC exam specifically tests the factor categories.)
- **Misconception:** An ACL can only be applied to files and folders. **Reality:** ACLs can be applied to many resources, including network devices (routers, switches), printers, databases, and cloud storage buckets. Any resource that needs access control can have an ACL. (New learners first see ACLs in file permission settings, so they assume that is the limit.)

## Key takeaways

- Logical access controls are software-based mechanisms that determine who can access a resource and what they can do with it.
- The four main types of logical access controls are passwords, tokens, certificates, and access control lists (ACLs).
- Passwords are something you know; tokens are something you have; biometrics are something you are — these three categories form the factors of authentication.
- Multi-factor authentication (MFA) requires at least two different factors, such as a password and a token.
- An access control list (ACL) is a set of rules that grants or denies permissions to users or groups for a specific resource.
- Certificates are digital documents issued by a Certificate Authority (CA) that bind an identity to a public key, used for authentication and encryption.
- The principle of least privilege means giving users only the minimum access they need to perform their job, often enforced via ACLs.
- In the AAA framework, authentication verifies identity, authorisation determines permissions, and accounting logs actions for review.
- Defence in depth uses multiple layers of logical access controls so that if one fails, others still protect the system.
- The CC exam will test your ability to identify which control to apply in a given scenario and to distinguish between different factors of authentication.

## FAQ

**What is the difference between a password and a token?**

A password is something you know (a secret string of characters). A token is something you have (a physical device or app that generates a code). They are different authentication factors.

**Do I need a certificate to use HTTPS on my website?**

Yes. HTTPS (secure web browsing) requires a TLS/SSL certificate, which is issued by a Certificate Authority. Without a certificate, the connection is not encrypted and users will see a security warning.

**Can an ACL be used on a network router?**

Yes. Network routers use ACLs to control which traffic is allowed or denied based on IP addresses, ports, and protocols. It is called a Network ACL (NACL).

**What is the principle of least privilege?**

It means giving users only the minimum permissions they need to do their job. For example, a receptionist should not have access to salary data. ACLs are often used to implement this principle.

**How do certificates prevent impersonation?**

A certificate is issued by a trusted Certificate Authority (CA). When a user or device presents a certificate, the system checks if it was signed by a known CA. If the signature is valid, the system trusts the identity. Without the private key that matches the certificate, no one can forge it.

**What happens if a security token is lost?**

The token should be immediately revoked by an administrator so it cannot be used. A new token is issued to the user, and its serial number is registered in the system.

**Is multi-factor authentication always required?**

No, it is not always required, but it is strongly recommended for sensitive systems. The CC exam expects you to know that MFA significantly reduces the risk of credential theft.

## Check your understanding

1. **Which authentication factor does a hardware token represent?**

   Answer: Something you have (possession factor).

2. **What is the primary purpose of a digital certificate?**

   Answer: To prove the identity of a user, device, or website, enabling trust and encryption.

3. **A file server uses a list that says 'UserA: read; UserB: read/write; UserC: no access'. What is this list called?**

   Answer: An access control list (ACL).

4. **What two factors are combined in multi-factor authentication?**

   Answer: Two different categories, typically something you know (password) and something you have (token) or something you are (biometric).

5. **In the AAA framework, which step involves reviewing logs after a security incident?**

   Answer: Accounting.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/isc2-cc/logical-access-controls