Access Control

When anyone—legitimate user or malicious hacker—authenticates to your system, the succeeding layer to authentication of your defense-in-depth strategy is access control. Access control limits users to only those resources and actions they have a legitimate reason to access or perform. When you design your access control strategy, adopt least privilege as your guiding principle. By limiting a user to only the resources and levels of access he or she requires, you reduce how much damage a rogue user or compromised user account can cause.

Control in Context
Access control takes slightly different forms depending on the context in which you apply it. You might need to define access control at the OS, database, and application levels. Sometimes network access control (i.e., limiting a user or device to specific subnets and ports within the intranet) is lumped in with access control (OS and application controls limiting which objects a user can access and how), and in principle, network access and access control within a system have much in common. Because these two layers of defense are usually implemented in different ways and within different components of your technology infrastructure, I see them as separate. . . .