Access control policies are integral to an organisation’s security strategy. These policies can be as simple as implementing authentication to access a particular resource or as comprehensive as policies defining what users can access.
However, these policies must be based on the principle of least privilege to ensure that sensitive information doesn’t fall into the wrong hands. The principle is relatively simple in theory: users and programs should only have access to the resources they need to accomplish their tasks. Restricting privileges to the bare minimum limits the damage that can be done by an external attacker or an insider threat.
In practice, this is far more complex to implement. Different access control models suit different organisational structures. Two of the most common models described in the Trusted Computer System Evaluation Criteria (TCSEC) are discretionary access control (DAC) and mandatory access control (MAC).
Discretionary access control
Discretionary access control is commonly implemented in civilian organisations and smaller government departments. These policies restrict access based on the identity of users or certain groups. Users in control of a resource can also grant or revoke access for other users without the assistance of an administrator.
This flexibility is itself a security risk. If a company gives each employee free rein across its systems and data—and lets employees grant access rights to others—a compromised or rogue account could cause extensive damage. An attacker could steal or delete data and, after obtaining elevated privileges, lock everyone else out. The broader the privileges, the more severe the potential impact.
Most employees don’t need much access
There is no guaranteed method of preventing disgruntled employees or hackers from attacking an organisation. Adopting the principle of least privilege can, however, mitigate the risk.
Mandatory access control enforces a security policy across all users and resources. Each is assigned a sensitivity label that forms the basis of access decisions. MAC policies are primarily adopted by military and intelligence departments, where security classifications determine whether a user has sufficient clearance to access a resource.
For example, the Australian government assigns protective markings to denote information sensitivity. Only people with the required security clearances can have ongoing access to specific resources.
| Protective marking | Impact if compromised | Security clearance required |
|---|---|---|
| UNOFFICIAL | No business impact | No security clearance requirements for access |
| OFFICIAL | Low business impact | No security clearance requirements for access |
| OFFICIAL: Sensitive | Low to medium business impact | No security clearance requirements for access |
| PROTECTED | High business impact | Ongoing access requires a Baseline security clearance or above |
| SECRET | Extreme business impact | Ongoing access requires a Negative Vetting 1 security clearance or above |
| TOP SECRET | Catastrophic business impact | Ongoing access requires a Negative Vetting 2 security clearance or above |
Role-based access control
While MAC policies are useful for military and intelligence organisations that handle sensitive national-interest information, many civilian organisations have different needs. Information must be protected without imposing unnecessarily cumbersome security policies. This is where role-based access control (RBAC) is most effective.
With RBAC, users are allocated roles based on the access rights they need. Unlike DAC, RBAC does not permit users to grant or revoke access rights at their discretion. Instead, organisation-specific guidelines and employee roles determine access. A banking system, for example, may define roles for bankers, accountants and secretaries, with privileges based on each role’s responsibilities.
RBAC applies the principle of least privilege while reducing the administrative burden of maintaining multiple security clearances and classifications. Each person can still access the tools, files and folders needed for their work. If an attack occurs, however, the damage is more limited because a compromised account exposes fewer resources.
Keep your system flexible and dynamic
Circumstances change, so access management must change with them. Organisations need to adapt quickly if they want to maintain least privilege without disrupting work. The approach can be challenging to establish, but the security benefits are substantial.
Protect your organisation and consult Gridware to see how we can help you administer user access more effectively.
