10.1.1 Access Control

10.1.1 Access Control Access control governs how subjects may interact with objects. When implemented on a computer system or network, access control is a type of logical security. Modern access control is typically implemented as an identity and access management (IAM) system. IAM comprises four main processes: Identification Creating an account or ID that uniquely represents the user, device, or process on the network. Authentication Proving that a subject is who or what it claims to be when it attempts to access the resource. Authorization Determining what rights subjects should have on each resource, and enforcing those rights. Accounting Tracking authorized usage of a resource or use of rights by a subject and alerting when unauthorized use is detected or attempted. For example, if you are setting up an e-commerce site and want to enroll users, you need to select the appropriate controls to perform each function: Identification Ensure that customers are legitimate. Authentication Ensure that customers have unique accounts and that only they can manage their orders and billing information. Authorization Rules to ensure customers can place orders only when they have valid payment mechanisms in place. Accounting The system must record the actions a customer takes (to ensure that they cannot deny placing an order, for instance).