Access Control and Identity Management, 3rd Edition

Purpose of Testing Access Control Systems

Access control systems, like any other technology, should work as designed. Unfortunately, like other security systems, access control systems are constantly under surveillance and attack. Access control systems are tempting targets because they provide the “keys to the kingdom,” literally and figuratively. An attacker who gains control of the access control system can leverage that access to gain entry to any other system in the enterprise. Frequent testing of access control systems ensures that weaknesses are found and can be dealt with before they are exploited.

There is no one correct way to test an access control system. Instead, a solid test should incorporate testing methodologies at different ...