chapter eleven

11 Logical Access Controls

 

This chapter covers

  • Access Control Models: DAC, MAC, and RBAC
  • Identity management technologies
  • The monitoring of logical access

In the previous chapter, we explored how administrative controls guide and regulate human behavior and how physical access controls use tangible barriers to restrict access to areas or assets. However, these measures alone are insufficient for protecting digital environments. This brings us to logical access controls, which use software-based mechanisms to authenticate users, authorize actions, and protect systems and data.

Logical controls add another layer of defense. Even if someone gains physical access to a device, these controls can prevent unauthorized use. For instance, accessing a computer’s data requires physical possession of the device and valid login credentials. Logical controls also help enforce administrative policies by defining when and how users can access systems. For example, they can limit logins to specific roles, locations, or times of day.

During a typical workday, users navigate multiple systems, applications, and data sources. Requiring a separate login for each would be inefficient and disruptive. To streamline this process, organizations implement identity and access management (IAM) solutions that centralize authentication while maintaining security, such as single sign-on (SSO) and federated identity management (FIM) systems.

11.1 Access Control Models

11.1.1 Discretionary access control (DAC)

11.1.2 Mandatory access control (MAC)

11.1.3 Role-Based access control (RBAC)

11.2 Identity Management

11.2.1 Directory services

11.2.2 Single Sign-On (SSO)

11.2.3 Federated Identity Management (FIM)

11.3 Monitoring Logical Access

11.3.1 Logical access logging

11.3.2 Log centralization

11.3.3 Typical suspicious access patterns

11.3.4 Privilege monitoring

11.4 Closing Thoughts

11.5 Summary

11.6 Review Questions

11.7 Answers to Review Questions