What is access control?
In most modern office environments, entry is governed by a system known as access control, which determines who may enter a building, a room or a digital resource, and under what circumstances. The term is used throughout the industry, in product data sheets, standards and bid specifications. In practice, access control is both the physical infrastructure at doors and gates and the software layer that manages permissions, logs and rules.
What is access control used for?
Access control is found in most modern offices, warehouses and healthcare facilities. Offices restrict access to floors and server rooms, warehouses protect loading docks against unauthorized pickups, hospitals separate staff areas from public areas, and data centers require multi-step verification at every mantrap door. Schools and preschools use the systems to keep unknown adults from moving freely through the building during school hours.
Many organizations combine access control with video surveillance and intrusion alarms. When an authorized card is read, the event is recorded in the log, and in the event of an alarm the operator can quickly see who last passed through a specific door.
Components and data flow
Technically, the system consists of four main parts that work together. A user presents something that identifies him or her, a reader reads the credential, a controller compares it against a set of rules, and a locking mechanism grants or denies entry. Both power and data run between these parts, usually over protected networks.
The components of a typical access control system are:
- a credential in the form of a card, key fob, mobile phone or biometrics
- a reader at the door or gate that registers the credential
- a controller or access control panel that makes the access decision
- a locking device, electric strike or magnetic lock that opens the passage
- management software for permissions, schedules and logs
- a network connection that links the parts together and enables remote management
Together, these components determine both how secure and how convenient the system feels. A well-configured system lets the right people in within a second and blocks everyone else without any drama.
Different types of identification and authentication
Identification in access control traditionally falls into three broad categories that the industry calls something you have, something you know and something you are. The security industry recommends combining at least two of them for sensitive areas, which is known as two-factor or multi-factor authentication (MFA).
RFID cards and key fobs are the most common solution in office environments. Mobile credentials using Bluetooth or NFC have gained ground since smartphones became work tools. PIN codes are still common in combination with cards, particularly for safes and server rooms. Biometrics such as fingerprint and facial recognition suit environments with higher security requirements, but are covered by data protection and privacy laws and require a specific legal basis.
Four access control models: DAC, MAC, RBAC and ABAC
When administrators decide which rules should apply, they usually start from one of four access control models. The model affects both flexibility and security level, and the choice depends on the needs of the organization.
- Discretionary Access Control (DAC) gives the owner of a resource the right to decide who is granted access. The model suits smaller environments and traditional file systems.
- Mandatory Access Control (MAC) is a strict model in which a central authority assigns security classifications to both users and resources. MAC is used mainly in government and defense, where classification levels are regulated.
- Role-Based Access Control (RBAC) assigns access based on role rather than identity. An accounting assistant automatically gets access to the finance system and nothing more. RBAC is widely used in larger organizations because it is easy to administer when staff change.
- Attribute-Based Access Control (ABAC) takes several attributes into account at once, such as the user's role, the time, the location and the device. The model is the most fine-grained but takes more work to maintain. ABAC is common in modern cloud-based solutions.
RBAC is a good starting point for many companies, because roles rarely change quickly. For an organization's most protected areas, such as server rooms, security-sensitive facilities or areas with stricter traceability requirements, RBAC is often supplemented with ABAC rules.
Requirements when choosing access control
In practice, three factors determine whether an access control system works: scalability, integration and operation. Scalability is about how many doors and users the solution can handle without performance or administration suffering. Integration determines whether the system can communicate sensibly with alarms, cameras and HR systems. Operation affects both cost and security over time, since firmware updates and card replacements are routine in an installation with many doors.
Early in the process, you map out which groups need access, which times apply and which areas require extra protection. That mapping guides both the choice of credential and the level of authentication. If the organization handles sensitive information, cybersecurity should be stated explicitly in the requirements specification, because modern solutions are network-connected and therefore potential targets for cyberattacks.
Documentation and ongoing management carry the system's protective value over time, yet they are often left out of the requirements specification. A solution that is installed correctly but not updated when employees leave quickly loses its value. The routines for assigning permissions, revoking them and carrying out periodic reviews are the system's real protective mechanism over time.
Global
