Access Controls

Access controls are security measures designed to restrict access to systems, data, and physical spaces to authorized individuals, devices, processes, or other entities. Effective access control involves several key steps: user identification, authentication (verifying the claimed identity), and authorization (granting, denying, or documenting access requests).

According to identity management company Permit, there are three primary types of access control models:

  • Role-based access control (RBAC): Permissions are assigned based on organizational roles.
  • Attribute-based access control (ABAC): Permissions are determined by evaluating attributes associated with users, resources, or the environment.
  • Relationship-based access control (ReBAC): Access decisions are based on the relationships between specific resources and identities.

Access controls can be applied at various levels (including network access, host operating systems, and physical entry points) and for specific functions (such as financial transactions, system configuration changes, or security administration).

According to identity management company Frontegg, identity and access management (IAM) systems typically include five core components:

  • Provisioning: creating and managing user identities and access rights
  • Authentication: verifying a user’s identity
  • Authorization: verifying that an authenticated user has the appropriate access rights
  • Audits and compliance: monitoring user activities and ensuring compliance with regulatory mandates
  • Deprovisioning: revoking user identities and access rights when they are no longer needed.

The Open Web Application Security Project (OWASP) provides several recommendations to mitigate authorization vulnerabilities, including

  • enforcing the principle of least privilege
  • denying access by default
  • validating permissions on every request
  • thoroughly reviewing the authorization logic of selected tools and technologies
  • preferring ABAC and ReBAC models over RBAC models where appropriate
  • ensuring that lookup IDs cannot be accessed or tampered with, even if guessed
  • enforcing authorization checks on static resources
  • verifying that authorization checks are performed in the correct location
  • safely exiting and invalidating session identifiers when authorization checks fail
  • implementing appropriate logging
  • creating unit and integration tests for authorization logic.

Commercial Off-the-Shelf Solutions and Simple Recommendations

  • AWS Identity and Access Management⁠1
  • Azure RBAC⁠2
  • Google Cloud IAM⁠3
  • Axiomatics⁠4
  • Auth0⁠5
  • IBM Verify Identity Governance⁠6
  • Permit.io⁠7
  • Java Authorization and Authentication Service⁠8
  • OWASP ESAPI Access Control feature⁠9
  • WorkOS⁠10

How Does This Relate to the Rest of the Guide or Other Threats That the User Cares About?

  • Access control: A.ART-1, A.DSAP-1, CC.ACA-1, CC.ACA-2, CC.PSC-1, COP.ACA-1, COP.ACA-2, COP.ACA-3, COP.ACA-4, D.ACA-1, D.DSSAC-1, HT.ACA-1, HT.ACA-2, HT.ACA-3, IE.ACA-1, IE.ACA-2, IE.MLCM-2, II.ACA-1, II.ACA-2, MT.ACG-1, MT.ACG-2, MW.ACA-1, MW.ACA-2
  • Access control:
    • Berryville Institute of Machine Learning (BIML): Model Extraction
    • API1:2023—Broken Object Level Authorization
    • API2:2023—Broken Authentication
    • API5:2023—Broken Function Level Authorization
    • ML01: Input Manipulation Attack
    • ML02: Data Poisoning Attack
    • ML03: Model Inversion Attack
    • ML05: Model Stealing Attack
    • ML06: AI Supply Chain Attack
    • LLM03: Training Data Poisoning
    • LLM05: Supply Chain Vulnerabilities
    • LLM06: Sensitive Information Disclosure
    • LLM07: Insecure Plugin Design
    • LLM10: Model Theft

Other Sources of Information About This Topic

  • “Authorization Cheat Sheet” (OWASP)⁠11
  • Guide to Attribute Based Access Control (ABAC) Definition and Considerations (NIST)⁠12
  • “Attribute‑Based Access Control (ABAC) vs Relationship‑Based Access Control (ReBAC)” (Permit.io)⁠13
  • “What Is Identity and Access Management (IAM)?” (Frontegg)⁠14
  • “Using Large Language Models (LLMs) in Access Management” (Open Identity Platform)⁠15
  • “Navigating AI Security: How Access Controls Can Make a Difference” (LinkedIn)⁠16
  • “What Is Identity and Access Management (IAM)?” (Red Hat)⁠17
  • “What Is Access Control? Authorization vs Authentication” (Cloudflare)⁠18

Notes

  1. Amazon Web Services, “AWS Identity and Access Management Documentation.” Return to content ⤴
  2. Microsoft, “Azure RBAC Documentation.” Return to content ⤴
  3. Google Cloud, “Roles and Permissions.” Return to content ⤴
  4. Paddy SR, “Secure Your RAG (Axiomatics).” Return to content ⤴
  5. Auth0, “Authorization for RAG.” Return to content ⤴
  6. IBM, “IBM Verify Identity Governance.” Return to content ⤴
  7. Ankor, “How to Implement RBAC with Permit.io.” Return to content ⤴
  8. Oracle, “Java Authentication and Authorization Service (JAAS) Reference Guide.” Return to content ⤴
  9. OWASP, “OWASP Enterprise Security API (ESAPI).” Return to content ⤴
  10. WorkOS, “Role-Based Access Control.” Return to content ⤴
  11. OWASP, “Authorization Cheat Sheet”; “A01:2021 — Broken Access Control.” Return to content ⤴
  12. Hu et al., “Guide to Attribute Based Access Control (ABAC) Definition and Considerations.” Return to content ⤴
  13. Bass, “Attribute-Based Access Control (ABAC) vs Relationship-Based Access Control (ReBAC).” Return to content ⤴
  14. Frontegg, “What Is Identity and Access Management (IAM)?.” Return to content ⤴
  15. Open Identity Platform, “Using Large Language Models (LLMs) in Access Management.” Return to content ⤴
  16. Abbasi, “Navigating AI Security: How Access Controls Can Make a Difference.” Return to content ⤴
  17. Red Hat, “What Is Identity and Access Management (IAM)?.” Return to content ⤴
  18. Cloudflare, “What Is Access Control? Authorization vs Authentication.” Return to content ⤴