How Access Control Protects Sensitive Information

Introduction

Data is without a doubt one of the most valuable commodities that companies currently have in this digital age. All records of clients, customer records, employee information, monetary information, intellectual property, company procedures, confidential files, passwords etc. require solid protection, and whilst digital means such as firewalls, antivirus programmers and encrypting have their job in cyber security, access control remains a fundamentally important method of protection. This essentially revolves around the restriction of access to the applications, system, hardware and indeed all information within and over what could then be accessed may be utilized with or without authorization.

What Is Access Control?

Access control is a type of security process that restricts who can access what, and how.

Access control is a simple thing that answers three important questions:

1. Who are you?
2. Are you allowed to access this resource?
3. What are you allowed to do with it?

For instance, an employee might have access to a customer database but not to change or delete customer records.

Likewise, a manager might be able to see the confidential financial reports, and a general employee might not.

Access control is used to ensure that sensitive information can only be accessed by those who are authorized to access it and that they cannot be accessed by unauthorized people.

Why Is Access Control Important?

Many organizations have vast amounts of sensitive data stored and retrieved. This may include:

• Customer personal information
• Financial records
• Employee information
• Medical records
• Intellectual property
• Business contracts
• Confidential emails
• Government information
• Login credentials

The research and development data is gathered.

Unauthorized access to this information could have serious repercussions.

If there’s a security breach, it could lead to:

• Financial losses
• Identity theft
• Legal consequences
• Regulatory penalties
• Operational disruption

Loss of customer trust

Damage to an organization’s reputation.

One way to minimize this risk is to use access control so that information is only available to the appropriate people.

The Three Main Components of Access Control

A good access control program usually consists of 3 primary processes:

1. Identification

Identification is when a user asserts an identity.

For instance, a person can identify themselves:

• A username
• An employee ID
• An email address
• A smart card
• A digital certificate

Identification is a response to the question:

Who do you say you are?

But identification is not the answer. The system needs to make sure that the person is really who they say they are.

2. Authentication

Authentication is the process of confirming the identity of a user.

Examples of authentication include:

Something You Know

Examples include:

• Passwords
• PINs
• Security answers

Something You Have

Examples include:

• Security tokens
• Smart cards
• Mobile authentication apps

Something You Are

These may include biometrics like:

• Fingerprints
• Facial recognition
• Iris scans

Using more than one authentication factor is known as Multi-Factor Authentication (MFA).

Using MFA can considerably enhance security because a stolen password might not be sufficient to allow an attacker access.

3. Authorization

Once the user is authenticated, the system decides what access the user is given.

This is known as authorization.

For example:

Employees have access to files in the department.

Financial reports can be viewed by a manager.

The server management can be done by an IT administrator.

• Each customer can only view his/her own account.

The principle of authorization is applied to the user, meaning that he or she is only given the permissions required to carry out his/her duties.

How Access Control Protects Sensitive Information

Access control protects information in several important ways.

1. Preventing Unauthorized Access

Access Control is the main objective of which is to stop unauthorized people from gaining access to sensitive resources.

Suppose a company has a database of its customers. If there were no restrictions, any employee (or even an attacker) could see and/or copy information.

Access control sets limits on sensitive resources.

They can only be accessed by users with suitable permissions.

This is protection for:

This protection applies to:

• Files
• Databases
• Applications
• Cloud services
• Networks
• Physical facilities

2. Ensure that stolen credentials are not used.

Passports may be stolen by:

• Phishing attacks
• Malware
• Data breaches
• Social engineering
• Password reuse

To minimize the risk of stolen credentials, access control systems can include extra security measures.

For instance, MFA calls for a second method of verification for the user.

If an attacker obtains a password, he or she may not be able to gain access to the account without:

A mobile authentication code is used to verify the identity.

• A security key
• A fingerprint

One other approved authentication factor

This provides an extra level of security for sensitive data.

3. Principle of least privilege – restricting access

The Principle of Least Privilege is one of the main principles of access control.

This principle is that the user is only to be given the minimum access required to do their jobs.

In the case of marketing, for instance, staff should not have administrative privileges to access the company’s financial database.

The more permissions you give, the more security risks you will have.

The basic idea of least privilege is to assist organizations in the following ways:

• Reduce insider threats

Prevent inadvertent data disclosure

• Preventing privilege abuse

Minimize damage caused by compromised accounts.

Limited permissions may stop an attacker operating with a low privilege account from gaining access to critical systems.

4. Reducing Insider Threats

There are external hackers, but not all security threats are external.

Sensitive information may be compromised unintentionally or intentionally through employees, contractors, vendors or other trusted people.

Examples include:

• Downloading confidential files
• Sharing sensitive information
• Accessing unauthorized records
• Stealing intellectual property
• Misusing administrative privileges

Control of access restrictions who can have access.

This helps to decrease the amount of misuse.

Organizations can also track access activity and pick out suspicious actions, including:

• Accessing unusual files
• Logging in at unusual times

The downloading of huge quantities of information.

Trying to access restricted systems

5. Securing Sensitive Data in the Cloud

Information is stored more in cloud environments in modern organization.

Cloud platforms enable access to information from various locations and devices, which poses further challenges for security.

Inadequate cloud access controls can open sensitive data to unauthorized access.

Cloud access control provides a strong way for organizations to manage:

• User permissions
• Administrator’s privileges
• Third-party access
• Application access
• Remote access

IAM systems can help to ensure that users are granted the right permissions in multiple clouds.

Understanding Identity and Access Management (IAM)

IAM systems can be used to manage:

Who can access the resources? Who has access to resources?

• What resources they can use
• When access is allowed

– At what points of the outer perimeter comes access

Actions that users can take:

A successful IAM approach enables organizations to manage access centrally, instead of having to manage permissions in hundreds of different systems manually.

IAM is especially crucial for organizations that have:

• Large workforce
• Remote employees
• Multiple cloud platforms
• Contractors and vendors
• Complex IT environments

Types of Access Control

Each organization can have a different access control model depending on their security demands.

• Discretionary Access Control (DAC)

Discretionary Access Control is a way to give access to a resource to the discretion of the owner of that resource.

The creator of a file might choose to allow some employees and not others to:

• Read the file
• Edit the file
• Share the file

DAC offers flexibility, but users can give themselves too much access and thus end up with security issues.

• Mandatory Access Control (MAC)

Mandatory access control is based on centrally defined security policies.

The permissions cannot be changed without restriction by the user.

The most common application of MAC would be in the following environments:

• Military organizations
• Government agencies
• Intelligence environments

Information can be categorized as:

• Public
• Confidential
• Secret
• Top Secret

Users can only access information if they are granted proper security clearance.

• Role Based Access Control (RBAC)

Role Based Access Control: Permissions are granted according to job roles.

For example:

Human Resources Role

May access:

• Employee records
• Recruitment information

Finance Role

May access:

• Financial systems
• Accounting records

IT Administrator Role

May access:

• Servers
• Network systems
• Security configurations

RBAC makes access management simpler because roles are assigned permissions instead of each user having to be assigned one one-by-one.

• Attribute-Based Access Control (ABAC)

Attribute Based Access Control is based on a number of attributes and checks if the access should be granted or not.

These attributes can consist of:

• User role
• Department
• Location
• Device
• Time
• Security clearance

For instance, a user can only view a private document if:

• They are in the right department.
• They are using an approved device.
• They are using the system within the hours it is supposed to be working.

• ABAC offers very flexible and dynamic security controls.

Access Control and the Zero Trust Security Model

Traditional security models usually assume that users within an organization’s network are to be trusted.

It has come to a new way of thinking in the world of cybersecurity: Zero Trust.

The basic tenet of Zero Trust is:

Never trust automatically. Always verify.

Under Zero Trust:

All users are authenticated.

All devices are assessed.

All accesses are verified.

• Permissions are limited.

Suspicious activity is monitored on an on-going basis.

One of the most fundamental elements of a Zero Trust architecture is access control.

Rather than assuming trust, organisations continually assess the issue of access.

The Importance of Multi-Factor Authentication

Today, passwords are not enough to secure sensitive information.

Multi-Factor Authentication is important in a good access control strategy.

MFA will ask users to enter more than one form of authentication.

For example:

1. Enter a password.
2. Authorize a log-in using a mobile app.

Or:

1. Enter a password.
2. Fingerprint or security key.

That makes it much more difficult to break into without authorization.

If a hacker successfully gets the login information, he or she might still not be able to finish the authentication.

Privileged Access Management

Access to some accounts is much greater than that of regular users.

They are called privileged accounts.

Examples include:

• System administrators
• Database administrators
• Cloud administrators
• Security administrators

If a privileged account is compromised, it can be very damaging.

If an attacker accesses the system as an administrator, he/she can:

• Disable security tools
• Access sensitive databases
• Create new accounts
• Steal confidential information
• Modify system configurations

Privileged Access Management (PAM) is a tool for organizations to manage and monitor strong accounts.

PAM can provide:

• Temporary privileged access
• Session monitoring
• Password management
• Approval workflows
• Activity logging

This decreases the risk with high level permissions.

Access Control in Physical Security

Access control is not a feature of digital systems alone.

It is also critical for physical security.

Physical access control systems safeguard:

• Office
• Data Centers
• Computer rooms
• Research labs
• Closed establishments

Common physical access technologies are:

• Access cards
• Keys and key fobs for cars
• Pin numbers
• Biometric scanner
• Face recognition

For example, a data center may be restricted to only authorized IT personnel.

This keeps critical infrastructure out of the hands of unauthorized people.

Final Thoughts

Fundamentally, access control is a building block of information security which provides protection to sensitive data by making sure that only the authorized people have access to respective systems, applications, facilities and data.

A good access control system consists of many components including identification, authentication, authorization, the principle of least privilege, multi-factor authentication, privileged access management, monitoring and periodic access reviews.

As organizations are becoming more digital and cyber threats are developing further, the importance of controlling the access to sensitive data will only increase.

In order to achieve success in access control, it is crucial not just to ask the questions like: “Who is trying to access our systems?”

Besides, organizations need to consider:

“Should this person have access to data, what exactly can they do and whether this access is still relevant?”

The application of efficient and smart access controls can help reduce possible risks of data leakage, internal and external threats and unauthorized access.

The protection of sensitive data begins with controlling who can access this data.