Fundamentals of Information Systems Security, 4th Edition

Four-Part Access Control

Before an asset can be protected, the entity wishing to protect the asset must know some information about the intended user and how that user should be allowed to interact with the asset. The four parts of access control provide this information along with the assurance that access is sufficiently managed:

• Identification—Who is asking to access the asset?

• Authentication—Are the requestors’ identities verified to be the claimed identities (i.e., are the users who they claim to be)?

• Authorization—What, exactly, can the requestors access? And what can they do?

• Accountability—How can actions be traced to an individual? It is important to be able to identify a person who accesses or makes changes to data or systems for ...