What are types of access control?

You can use two broadly defined models to implement access control: role-based access control (RBAC) and attribute-based access control (ABAC). Each model has advantages and disadvantages, which are briefly discussed in this section. The model you should use depends on your specific use case. The architecture discussed in this guide supports both models.

RBAC

Role-based access control (RBAC) determines access to resources based on a role that usually aligns with business logic. Permissions are associated with the role as appropriate. For instance, a marketing role would authorize a user to perform marketing activities within a restricted system. This is a relatively simple access control model to implement because it aligns well to easily recognizable business logic.

The RBAC model is less effective when:

• You have unique users whose responsibilities encompass several roles.

• You have complex business logic that makes roles difficult to define.

• Scaling up to a large size requires constant administration and mapping of permissions to new and existing roles.

• Authorizations are based on dynamic parameters.

ABAC

Attribute-based access control (ABAC) determines access to resources based on attributes. Attributes can be associated with a user, resource, environment, or even application state. Your policies or rules reference attributes and can use basic Boolean logic to determine whether a user is permitted to perform an action. Here’s a basic example of permissions:

In the payments system, all users in the Finance department are allowed to process payments at the API endpoint /payments during business hours.

Membership in the Finance department is a user attribute that determines access to /payments. There is also a resource attribute associated with the /payments API endpoint that permits access only during business hours. In ABAC, whether or not a user can process a payment is determined by a policy that includes the Finance department membership as a user attribute, and the time as a resource attribute of /payments.

The ABAC model is very flexible in allowing dynamic, contextual, and granular authorization decisions. However, the ABAC model is difficult to implement initially. Defining rules and policies as well as enumerating attributes for all relevant access vectors require a significant upfront investment to implement.

RBAC-ABAC hybrid approach

Combining RBAC and ABAC can provide some of the advantages of both models. RBAC, being aligned so closely to business logic, is simpler to implement than ABAC. To provide an additional layer of granularity when making authorization decisions, you can combine ABAC with RBAC. This hybrid approach determines access by combining a user’s role (and its assigned permissions) with additional attributes to make access decisions. Using both models enables simple administration and assignment of permissions while also permitting increased flexibility and granularity pertaining to authorization decisions.

Access control model comparison

The following table compares the three access control models discussed previously. This comparison is meant to be informative and high-level. Using an access model in a specific situation might not necessarily correlate to the comparisons made in this table.

The benefits of access control are pretty obvious when you think about it. Having a building-wide system can protect your employees, patrons, information, equipment and other assets without question.

The Three Types of Access Control Systems

In brief, access control is used to identify an individual who does a specific job, authenticate them, and then proceed to give that individual only the key to the door or workstation that they need access to and nothing more. Access control systems come in three variations: Discretionary Access Control (DAC), Managed Access Control (MAC), and Role-Based Access Control (RBAC).

1. Discretionary Access Control (DAC)
Discretionary Access Control is a type of access control system that holds the business owner responsible for deciding which people are allowed in a specific location, physically or digitally. DAC is the least restrictive compared to the other systems, as it essentially allows an individual complete control over any objects they own, as well as the programs associated with those objects. The drawback to Discretionary Access Control is the fact that it gives the end-user complete control to set security level settings for other users and the permissions given to the end-user are inherited into other programs they use which could potentially lead to malware being executed without the end-user being aware of it.

2. Managed Access Control (MAC)
Managed Access Control is more commonly utilized in organizations that require an elevated emphasis on the confidentiality and classification of data (ie. military institutions). MAC doesn’t permit owners to have a say in the entities having access in a unit or facility, instead, only the owner and custodian have the management of the access controls. MAC will typically classify all end users and provide them with labels that permit them to gain access through security with established security guidelines.

3. Role-Based Access Control (RBAC)
Also known as Rule-Based Access Control, RBAC is the most demanded in regard to access control systems. Not only is it in high demand among households, RBAC has also become highly sought-after in the business world. In RBAC systems, access is assigned by the system administrator and is stringently based on the subject’s role within the household or organization and most privileges are based on the limitations defined by their job responsibilities. So, rather than assigning an individual as a security manager, the security manager position already has access control permissions assigned to it. RBAC makes life much easier because rather than assigning multiple individuals particular access, the system administrator only has to assign access to specific job titles.

Request Information

Benefits of Access Control

1. Knowing Who’s Coming and Going at All Times
Many businesses have equipment and physical assets that are valuable on-site. An access control system keeps track of who’s coming and going to ensure that someone hasn’t snuck into the building. If a business is large with a lot of employees, it can be difficult for everyone to know who is an employee and who is not. An Access Control System helps prevent strangers from slipping in undetected.

2. Keep Track of Employees
If a business has multiple shifts with large groups of employees coming and going at odd hours, an Access Control System can help organize the chaos and inform you if an employee is in the building when they shouldn’t be. It can also help you keep track of who has shown up for work and who hasn’t.

3. Secure Sensitive Documents and Data
Many businesses have documents or data that should not be accessible to everyone in the company. An access control system allows a business to limit the access to certain areas that hold hardware or software that this information is saved on.

4. Reduce Theft and Accidents
An Access Control System allows a business to give only approved or specially trained employees access to areas that may hold valuable or dangerous equipment.

5. Multi-Property Protection
An integrated access control system will allow a business to grant access to employees who need to enter multiple or all buildings.

6. No More Worrying About Keys
When an employee quits and fails to return their keys, the business is stuck with the expense of making new keys and possibly even changing the locks. The same would apply when an employee loses his or her company keys. If the employee left on bad terms, this also removes the chance that they will try to re-enter the building and do damage.

With an access control system, the business can just remove the employee’s access from the system digitally.

Request a Consultation

How Access Control Works

1.  Access control readers give access to the building based on established credentials. Things like a key card, key fob, or biometrics like fingerprints are all considered established credentials.
    
2. Door readers are connected to a network. Every person who needs access has a code tied to their credential and the system recognizes that they are authorized to be in the building.
    
3. Software tracks who enters and exits the building and has the ability to alert security supervisors, business owners, etc. when someone enters the building after hours or there is a break-in.

Your Security Needs and Access Control

When it comes to protecting your home or business, as well as the building’s occupants, access control is one of the best ways for you to achieve peace of mind. But, access control is much more than just allowing people to access your building, access control also helps you effectively protect your data from various types of intruders and it is up to your organization’s access control policy to address which method works best for your needs.

There are a number of access control systems you can choose from that can be used in your residence or business facility, depending on your security needs.

Outlined below is an overview of the three basic types of access control systems that are available to your company so you can see which are best suited for your day-to-day operations.

Choosing the Best Access Control System for Your Organization

As you can see, when it comes to choosing the type of access control system that is most suitable for your organization, there are a number of factors involved. Some of those factors include the nature of your business, security procedures within the organization, and the number of users on the system.

Places of business with small or basic applications will probably find Discretionary Access Control to be less complicated and better utilized. If, however, you have highly confidential or sensitive information on your business platform, a Managed Access or Role-Based Access Control system are two options you may want to consider.

Please reach out to us at (888) 767-2794  for more information or connect with us here.

What are the 4 types of access control?

What are the 2 types of access control?

What are the five categories of access control?

What are examples of access controls?