What Is Access Control?

Key takeaways

• Access control is a process that companies and organizations use to determine which users can have access to specific confidential information, such as customer data and intellectual property.

• Access control systems use authentication and authorization processes to determine user access.

• Role-based access control systems limit access based on users' positions within an organization and the resources they need to fulfill their roles.

Three types of access control include discretionary, mandatory, and attribute-based. Continue reading to learn what access control is, why it's important, and common types. Then, if you're ready to get on the fast track to a career in cybersecurity, consider enrolling in the Google Cybersecurity Professional Certificate. In this beginner-level nine-course series, you'll have the opportunity to understand the importance of cybersecurity practices and their impact on organizations, learn how to protect networks, devices, people, and data from unauthorized access and cyberattacks using security information and event management (SIEM) tools, and identify common risks, threats, and vulnerabilities, as well as techniques to mitigate them.

What is access control?

Access control is a process that helps companies ensure only authorized users have access to data and determine the levels of access users have. By requiring authentication, organizations can limit access to confidential information, such as intellectual property, personal information, and customer data. Access control is crucial for limiting cyber threats, including data breaches, phishing attacks, and other attack vectors.

Common types of access control

You can help safeguard sensitive information by implementing various information technology access control models and by providing different methods for managing access to information. Take a look at four of the most common types of access control:

• Discretionary access control (DAC): In DAC systems, all information or objects within a system have a user who owns them and can assign specific access rights. Users who receive access can then choose to grant access to other users.

• Mandatory access control (MAC): Mandatory access control is an especially strict system in which access is determined by a system administrator. In this system, users don’t have the ability to grant access. This model is commonly used by the government, and users have varying levels of clearance or tiers.

• Attribute-based access control (ABAC): Attribute-based access control manages access by evaluating numerous attributes, and it is highly flexible. ABAC considers a combination of different attributes and characteristics, as well as certain environmental conditions, such as the time of day and location.

• Role-based access control (RBAC): In RBAC systems, user access is limited to what is necessary to carry out their role within the organization. In the event a user were to change positions within an organization, the system administrator adjusts access to reflect the needs of their current role.

Importance of authentication and authorization in access control

Both authentication and authorization play an important role in the access control process. Authentication requires users to provide information to log in to a system, such as an email address. Through authentication, the system can validate the user's identity. The next step of authorization determines the specifics of a user's access based on the security policy, reducing the risk of fraud.

Read more: Multi-Factor Authentication: Enhancing Security with Multiple Verification Factors

Related terms

• Authentication

• Public key

• Cybersecurity

• Just-in-Time access

• Identity and access management

Learn more about cybersecurity with our free resources

Keep up with industry trends and career advice by subscribing to our YouTube channel. Then, learn more about cybersecurity foundations, roles, and career paths with these free resources:

• Bookmark for easy access: Cybersecurity Glossary: Essential Terms and Definitions

• Watch on YouTube: Cybersecurity for Beginners: Your 3-Minute Crash Course

• Take a quiz: Cybersecurity Career Quiz: Is It Right for You? Find Your Role

Whether you want to develop a new skill, get comfortable with an in-demand technology, or advance your abilities, keep growing with a Coursera Plus subscription. You’ll get access to over 10,000 flexible courses from over 350 top universities and companies.