# Access Control Fundamentals and Models

> Chapter 2 of the Courseiva ISC2-SSCP curriculum — https://courseiva.com/learn/isc2-sscp/access-control-fundamentals-and-models

**Official objective:** 3.1 — Implement and manage access controls based on industry standards and best practices.

## Introduction

Access control is the gatekeeper of any computer system—it decides who can enter, what they can do once inside, and what they cannot touch. For the SSCP exam, understanding these fundamentals is essential because nearly every security question hinges on how access is granted, managed, and audited. Without access control, anyone could read your emails, delete your files, or impersonate you.

## The Office Building Access Card Analogy

A modern office building uses an electronic access card system to control who enters each floor. Every employee receives a card encoded with their specific permissions: which doors they can open, which floors they can access, and during what hours. The card itself does not grant access—it only presents credentials. The building's central security system checks the card's data against a stored policy each time the card is swiped. This is exactly how access control works in computing. The card is your user ID and password. The building's security system is the access control mechanism. The central policy database that says 'Jane can enter Floor 3, but only on weekdays' is the access control model—the rules that define who gets what access, when, and under what conditions. If Jane tries to enter the server room at midnight, the system denies her entry even if her card works on other floors. The building also logs every access attempt, just as IT systems log every authentication and authorisation event. An access control model is the set of rules the system follows to make those decisions consistently and securely.

## Core explanation

Access control is the process of restricting entry or action to a resource based on a set of rules. Think of it as a bouncer at a club: the bouncer checks your ID (authentication), verifies whether you are on the guest list (authorisation), and then tracks when you leave (accounting). These three steps—authentication, authorisation, and accounting—form the AAA framework, which is foundational to access control.

Authentication is proving you are who you claim to be. This can be done with something you know (a password), something you have (a smart card or phone), or something you are (a fingerprint or retina scan). Systems often combine two or more of these factors—this is multi-factor authentication (MFA). For example, a bank ATM uses your card (something you have) and your PIN (something you know).

Authorisation happens after authentication. It determines what an authenticated user is allowed to do. This is where access control models shine. There are several models, each with different rules for making authorisation decisions. The three primary models you need for SSCP are:

- Discretionary Access Control (DAC): The owner of a resource decides who can access it. In a DAC system, if you create a file, you can grant read or write permissions to specific users. This is flexible but can be insecure because users might give access to the wrong people. Microsoft Windows file permissions are a classic example of DAC—right-click a file, go to Properties, and you can set permissions for any user.

- Mandatory Access Control (MAC): The system, not the user, decides access based on labels. Every resource gets a classification label (e.g., TOP SECRET, SECRET, CONFIDENTIAL, UNCLASSIFIED), and every user gets a clearance label. A user can only access a resource if their clearance is equal to or higher than the resource's classification. For example, a user with a SECRET clearance can read a CONFIDENTIAL document but cannot read a TOP SECRET document. MAC is used in military and government systems where data sensitivity is paramount.

- Role-Based Access Control (RBAC): Access is based on a user's job role, not their individual identity. Instead of granting permissions to Jane personally, you grant permissions to the role 'Accountant' and then assign Jane to that role. If Jane changes departments, you simply reassign her to a new role—you do not have to redo all her permissions. RBAC is the most common model in corporate settings because it is manageable and scalable. Microsoft Entra ID uses RBAC to grant access to cloud resources based on roles like 'Global Administrator' or 'User Administrator'.

Another important model is Rule-Based Access Control, where access is granted or denied based on a set of rules defined by an administrator—for example, 'Allow access to the database only between 9 AM and 5 PM'. This is often combined with other models.

The last piece is accounting, or auditing. Every access attempt—successful or not—should be logged. These logs are critical for detecting security incidents (like someone trying to access a restricted file repeatedly), for compliance audits, and for investigating breaches after they happen.

Access control replaces the old, insecure model where everyone shared one password to a system. Before modern access control, a single user might have full control over everything, with no record of who did what. Today, access control ensures the principle of least privilege: each user gets only the permissions necessary to do their job, nothing more. It also enforces separation of duties—for example, the person who approves a purchase order should not be the same person who processes the payment.

## Real-world context

As an IT professional, you will implement and manage access controls in nearly every system you touch. Let's walk through a typical day for a systems administrator named Alex.

Alex starts the morning by reviewing a ticket: a new employee, Priya, has joined the finance team. Priya needs access to the company's accounting software, the shared drive for financial reports, and the monthly payroll files. Alex does not create permissions from scratch for Priya. Instead, Alex opens the identity management system, which is built on RBAC. Alex finds the role 'Finance Team Member' and assigns Priya to it. That role already has the correct permissions: read/write access to the accounting software, read access to the shared drive, and read/write access to the payroll folder. In minutes, Priya has exactly the access she needs.

Later that morning, Alex gets another ticket: a manager, Bob, is leaving the company. Alex disables Bob's user account immediately. But Alex also needs to review whether Bob had any shared or delegated permissions. Alex checks the access logs—part of accounting—to see who Bob had granted access to his files (a remnant of DAC). Alex finds that Bob had given his assistant, Sarah, access to a sensitive client list. Because Sarah still needs that access for her role, Alex transfers the permission to Sarah's role rather than leaving it attached to Bob's disabled account. This is a real-world example of cleaning up after DAC.

In the afternoon, Alex receives a security alert: someone tried to access a confidential HR document from an unknown IP address at 2 AM. Alex pulls the authentication logs and sees that the attempt used a valid username but the wrong password three times, then stopped. The system's rule-based access control blocked the attempt because access outside business hours was already restricted. Alex notes this for the compliance audit.

At the end of the week, Alex attends a planning meeting for a new cloud application. The team decides to use Microsoft Entra ID for authentication and RBAC for authorisation. Alex explains that they need to define roles carefully to follow the principle of least privilege—no role should grant more permissions than necessary. They also decide to implement MFA for any role that accesses sensitive data, because a password alone is not enough.

The tools Alex uses daily include:
- Active Directory or Microsoft Entra ID for managing users, groups, and roles
- Group Policy Objects (GPOs) to enforce rule-based access controls on Windows machines
- File server permissions (DAC in Windows Explorer)
- Log monitoring tools (like Microsoft Sentinel or Splunk) for accounting
- Role management interfaces in cloud platforms (AWS IAM, Azure RBAC, Google Cloud IAM)

The skills Alex needs include understanding each access control model's strengths and weaknesses, knowing how to assign roles without over-provisioning, and being able to read and interpret access logs. A common mistake is leaving a user in a role longer than needed—Alex sets quarterly reviews to remove stale permissions.

This scenario shows that access control is not just about technology; it is about policy, process, and vigilance. An IT professional does not just set it and forget it—they constantly audit, adjust, and enforce.

## Exam focus

The SSCP exam tests your ability to identify and apply access control models in scenario-based questions. You will get several questions that describe a situation and ask you to choose the correct model or concept. Here is exactly what to expect.

First, you must memorise the three core models—DAC, MAC, and RBAC—and their characteristics. The exam loves to present a scenario where an employee creates a file and grants access to another person, then asks which model was used. The answer is almost always DAC, because the owner has discretion. A scenario where a system enforces labels and clearances (like military classification) is always MAC. A scenario where access is determined by job function (e.g., 'HR Manager') is RBAC.

Common traps include:
- Confusing authentication with authorisation. The exam might ask: 'A user provides a username and password. What is this called?' The answer is authentication, not authorisation.
- Assuming that because a user is authenticated, they can do anything. The exam tests that authorisation is separate and must be explicitly granted.
- Mixing up rule-based access control with RBAC. Rule-based is 'if-then' rules (time of day, IP address). RBAC is about roles. The exam may offer both as options.
- Forgetting that MAC does not let the user change permissions—only an administrator can change labels.

Concepts you must know cold:
- The AAA framework: Authentication (proving identity), Authorisation (granting access), Accounting (logging).
- The principle of least privilege: give only what is necessary.
- Separation of duties: no single person should have conflicting permissions (e.g., can both create a purchase order and approve payment).
- Multi-factor authentication (MFA): two or more factors from different categories (knowledge, possession, inherence).
- The difference between centralised access control (one server decides, like RADIUS) and decentralised (each system decides).
- The concept of 'implicit deny': if no rule explicitly allows access, it is denied. This is the default stance of all access control systems.

Question patterns on the exam include:
- 'Which access control model allows the data owner to set permissions?' Answer: DAC.
- 'Which model uses security labels?' Answer: MAC.
- 'An organisation wants to assign permissions based on job title. Which model is best?' Answer: RBAC.
- 'What does the second A in AAA stand for?' Answer: Authorisation.
- 'An administrator implements a rule that no one can log in from outside the office network. What is this called?' Answer: Rule-based access control.

The exam also tests your ability to recognise when a company is violating the principle of least privilege or separation of duties. For example, a scenario where the same person can approve invoices and process payments is a violation of separation of duties. Your job is to spot that and recommend either RBAC (to assign these tasks to different roles) or a rule-based control (to block a single person from doing both).

Finally, the exam expects you to know that access control is a continuous process, not a one-time event. Periodic reviews, log monitoring, and role updates are part of maintaining a secure access control system.

## Step by step

1. **Identify the Resource and User** — First, determine what resource (file, database, network) needs protection and who the user is. For example, a payroll spreadsheet and a new finance employee. This step establishes the scope of access control.
2. **Authenticate the User** — Verify the user's identity using one or more factors: something they know (password), something they have (smart card), or something they are (fingerprint). Without successful authentication, no access is allowed.
3. **Determine the Authorisation Policy** — Choose which access control model to apply: DAC (owner sets rules), MAC (labels and clearances), RBAC (based on role), or rule-based (conditions). The policy defines who gets what access.
4. **Grant or Deny the Access Request** — The system evaluates the request against the policy. If the user's identity, role, or clearance matches the policy's conditions, access is granted. If not, the request is denied (implicit deny).
5. **Log the Access Attempt** — Record the event—whether access was granted or denied—with details like user ID, resource, timestamp, and outcome. These logs are crucial for auditing, incident detection, and compliance.
6. **Review and Update Permissions Periodically** — Regularly audit user permissions to ensure they still match job roles, remove stale accounts, and adjust for role changes. This step prevents permission creep and maintains least privilege.

## Comparisons

### Discretionary Access Control (DAC) vs Mandatory Access Control (MAC)

**Discretionary Access Control (DAC):**
- Owner of resource sets permissions.
- Used in less sensitive environments (e.g., personal files).
- Users can change permissions for their files.

**Mandatory Access Control (MAC):**
- System sets permissions based on labels.
- Used in high-security environments (e.g., military).
- Users cannot change permissions for any resource.

### Role-Based Access Control (RBAC) vs Rule-Based Access Control

**Role-Based Access Control (RBAC):**
- Access based on a user's job role.
- Roles are static; they do not change based on conditions.
- Commonly used in corporate identity management (e.g., Microsoft Entra ID).

**Rule-Based Access Control:**
- Access based on conditions (e.g., time, location).
- Rules are dynamic; access can change based on context.
- Often used for network firewalls or time-based restrictions.

### Authentication vs Authorisation

**Authentication:**
- Proves identity: 'Who are you?'
- Uses passwords, biometrics, or tokens.
- Happens first in the access control process.

**Authorisation:**
- Determines permissions: 'What can you do?'
- Uses access control models (DAC, MAC, RBAC).
- Happens after authentication is successful.

### Principle of Least Privilege vs Separation of Duties

**Principle of Least Privilege:**
- Focuses on minimal permissions per user.
- Goal is to reduce attack surface.
- Example: a data entry clerk cannot delete records.

**Separation of Duties:**
- Focuses on dividing tasks to prevent fraud.
- Goal is to create checks and balances.
- Example: the person ordering supplies cannot approve payment.

## Diagram

_Flowchart showing the access control process from user request through authentication, authorisation policy check, to grant or deny with logging._

```mermaid
flowchart TD
    A[User Request] --> B{Authentication: Prove who you are?}
    B -->|Success| C{Authorisation: What can you do?}
    B -->|Failure| D[Deny Access and Log]
    C -->|Check Policy| E{DAC, MAC, RBAC, or Rule-Based}
    E -->|Grant| F[Access Granted. Log event.]
    E -->|Deny| G[Access Denied. Log event.]
```

## Common misconceptions

- **Misconception:** If I am logged in and authenticated, I can access anything on the system. **Reality:** Authentication only proves your identity. Authorisation is a separate step that grants or denies access to specific resources based on policy. Being authenticated does not mean you are authorised. (Many beginners conflate logging in with having full access, because on personal computers, one user account often has full control. But in corporate systems, authentication and authorisation are distinct processes.)
- **Misconception:** Discretionary Access Control (DAC) is always more secure than Role-Based Access Control (RBAC). **Reality:** RBAC is generally more secure in organisations because it prevents users from inadvertently granting access to the wrong people. DAC gives control to individual users, which often leads to over-sharing. (The word 'discretionary' sounds flexible and user-friendly, but in security, flexibility often reduces security. Beginners assume control by the owner is better, but centralised role management is more secure and auditable.)
- **Misconception:** Multi-factor authentication (MFA) is an access control model. **Reality:** MFA is a method of authentication, not a model of authorisation. Access control models (DAC, MAC, RBAC) define how access decisions are made after authentication. MFA only strengthens the first step—authentication. (Because MFA is a high-profile security feature, beginners often lump it into the access control category. But the SSCP distinguishes between authentication (proving identity) and authorisation (granting permissions).)
- **Misconception:** If a user has been authorised once, they remain authorised until they log out. **Reality:** Authorisation is usually rechecked for every access request. A user may be authorised to access a file at one moment but not later if permissions change. The system enforces the policy at the time of the request. (People think of login as a one-time permission to access everything in a session. But access control systems constantly evaluate each request against current policies, especially for sensitive resources.)
- **Misconception:** Role-Based Access Control (RBAC) and Rule-Based Access Control are the same thing. **Reality:** RBAC assigns permissions based on job roles (e.g., 'Manager'), while rule-based control uses conditions like time of day or IP address. They are different models and often used together. (The names sound similar ('role' vs 'rule'), and both involve predefined criteria. But understanding the distinction is critical for exam questions that offer both as answer choices.)

## Key takeaways

- Access control has three components: authentication (who you are), authorisation (what you can do), and accounting (logging what you did).
- The principle of least privilege means giving each user only the permissions required to do their job and no more.
- Discretionary Access Control (DAC) lets the resource owner set permissions, which is flexible but risky.
- Mandatory Access Control (MAC) uses labels and clearances and is controlled entirely by the system, not by users.
- Role-Based Access Control (RBAC) grants permissions based on job roles, making it easier to manage in large organisations.
- Separation of duties ensures that no single person has conflicting permissions that would let them commit fraud or bypass controls.
- Implicit deny is the default stance of all access control systems: if no rule explicitly allows access, it is denied.
- Multi-factor authentication (MFA) requires two or more different types of credentials to verify identity.
- Rule-based access control allows administrators to set conditions like time-of-day or location restrictions.
- Access control is not a one-time setup; it requires ongoing review, audit, and adjustment to remain secure.

## FAQ

**What is the difference between authentication and authorisation?**

Authentication checks who you are (e.g., by verifying a password). Authorisation determines what you are allowed to do after authentication (e.g., read a file or delete it). They are separate steps.

**Do I need to know all three access control models for SSCP?**

Yes. DAC, MAC, and RBAC are frequently tested. You must be able to identify which model is being used in a scenario and explain the key differences between them.

**What does 'principle of least privilege' mean in practice?**

It means giving a user only the permissions they need to perform their job and nothing more. For example, a customer service agent does not need access to payroll files.

**How does RBAC make managing permissions easier?**

Instead of assigning permissions to each individual user, you assign permissions to a role (like 'Manager'), and then add users to that role. Changing permissions for an entire team becomes a single update to the role.

**What is the difference between RBAC and rule-based access control?**

RBAC grants access based on a user's job role. Rule-based access control uses conditions like time of day, IP address, or device type. They are separate models and often used together.

**Is multi-factor authentication (MFA) an access control model?**

No. MFA is a method of authentication, not a model of authorisation. It strengthens how the system verifies identity, but it does not define how access decisions are made after authentication.

## Check your understanding

1. **What is the primary difference between DAC and MAC?**

   Answer: In DAC, the resource owner sets permissions; in MAC, the system sets permissions based on security labels and clearances.

2. **Which access control model is best suited for a large organisation where employees change roles frequently?**

   Answer: Role-Based Access Control (RBAC), because permissions are tied to roles, not individuals, making it easy to add, remove, or reassign users.

3. **What does the 'accounting' component of AAA involve?**

   Answer: Accounting involves logging all access attempts (successful and failed) for auditing, monitoring, and compliance purposes.

4. **A user logs in with a password and a smart card. What is this called?**

   Answer: This is multi-factor authentication (MFA), because it uses something you know (password) and something you have (smart card).

5. **What is the default rule if no access control rule explicitly allows access?**

   Answer: Implicit deny: if no rule grants access, the system automatically denies the request.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/isc2-sscp/access-control-fundamentals-and-models