Access Control - Revision history

User at 18:34, 30 August 2023

2023-08-30T18:34:11Z

User at 17:06, 18 July 2023

2023-07-18T17:06:30Z

User at 02:48, 4 August 2022

2022-08-04T02:48:53Z

User at 20:19, 17 February 2021

2021-02-17T20:19:46Z

User at 20:10, 17 February 2021

2021-02-17T20:10:42Z

User at 18:40, 17 February 2021

2021-02-17T18:40:25Z

User at 18:35, 17 February 2021

2021-02-17T18:35:48Z

User at 18:11, 17 February 2021

2021-02-17T18:11:07Z

User at 18:03, 17 February 2021

2021-02-17T18:03:50Z

User at 17:53, 17 February 2021

2021-02-17T17:53:29Z

@@ Line 13: / Line 13: @@
 In this understanding, objects could be resources that you want to protect from unauthorized access, use, or disclosure. And the subject is the user (or group of users or even non-person entities such as applications or services) that the access controls apply to. So, access controls (in a more technical sense) are the tools, policies, [[Model|models]], and mechanisms that enable you to grant or restrict access to your [[Organization|organization’s]] digital or physical resources. This includes everything from restricting or granting access to specific files and [[Database (DB)|databases]] to IT systems and physical locations.
-If you look at the definitions of access control on the National Institute of Standards and Technology (NIST) website, you’ll see a lot of variations. However, they all basically mean the same thing in a roundabout way: access control is a way for you to ensure that only the individuals (or groups) you choose have access to your sensitive data, [[Application|applications]], [[Technology|technologies]], and critical infrastructure.
+If you look at the definitions of access control on the National Institute of Standards and Technology (NIST) website, you’ll see a lot of variations. However, they all basically mean the same thing in a roundabout way: access control is a way for you to ensure that only the individuals (or groups) you choose have access to your sensitive data, [[Application|applications]], technologies, and critical infrastructure.
 Basically, these types of physical and logical restrictions prevent unauthorized individuals from doing things they shouldn’t with your sensitive [[System|systems]] or data. Furthermore, they also help to prevent inadvertent exposure or disclosure of sensitive items.<ref>What is Access Control? - A Technical Definition [https://www.thesslstore.com/blog/the-role-of-access-control-in-information-security/ The SSL Store]</ref>

@@ Line 147: / Line 147: @@
 *[[Information Security Management System (ISMS)]]
 *[[Information Security Risk Management (ISRM)]]
 ===References===
 <references/>

@@ Line 131: / Line 131: @@
 *Manage: Managing an access control system includes adding and removing authentication and authorization of users or systems. Some systems will sync with G Suite or Azure Active Directory, streamlining the management process.
 *Audit: Frequently used as part of access control to enforce the principle of least privilege. Over time, users can end up with access they no longer need, e.g. when they change roles. Regular audits minimize this [[Risk|risk]].
 ===References===
 <references/>

@@ Line 45: / Line 45: @@
 [[File:Access Control Using Serial Controllers.png|300px|Access control system using serial controllers]]<br />
 Access control system using serial controllers
 *Serial main and sub-controllers. All door hardware is connected to sub-controllers (a.k.a. door controllers or door interfaces). Sub-controllers usually do not make access decisions, and instead forward all requests to the main controllers. Main controllers usually support from 16 to 32 sub-controllers.
@@ Line 53: / Line 54: @@
 **Disadvantages:
 ***Operation of the system is highly dependent on main controllers. In case one of the main controllers fails, events from its sub-controllers are not retrieved, and functions that require interaction between sub-controllers (i.e. anti-passback) stop working.
-***Some models of sub-controllers (usually lower cost) do not have the memory or processing power to make access decisions independently. If the main controller fails, sub-controllers change to degraded mode in which doors are either completely locked or unlocked, and no events are recorded. ***Such sub-controllers should be avoided, or used only in areas that do not require high security.
+***Some models of sub-controllers (usually lower cost) do not have the memory or processing power to make access decisions independently. If the main controller fails, sub-controllers change to degraded mode in which doors are either completely locked or unlocked, and no events are recorded.
 ***Main controllers tend to be expensive, therefore such a topology is not very well suited for systems with multiple remote locations that have only a few doors.
 ***All other RS-485-related disadvantages listed in the first paragraph apply.
@@ Line 59: / Line 61: @@
 [[File:Access control system using serial main and sub-controllers.png|300px|Access control system using serial main and sub-controllers]]<br />
 Access control system using serial main and sub-controllers
 *Serial main controllers & intelligent readers. All door hardware is connected directly to intelligent or semi-intelligent readers. Readers usually do not make access decisions, and forward all requests to the main controller. Only if the connection to the main controller is unavailable, will the readers use their internal database to make access decisions and record events. Semi-intelligent reader that have no database and cannot function without the main controller should be used only in areas that do not require high security. Main controllers usually support from 16 to 64 readers. All advantages and disadvantages are the same as the ones listed in the second paragraph.
@@ Line 64: / Line 67: @@
 [[File:Access control system using serial main controller and intelligent readers.png|300px|Access control system using serial main controller and intelligent readers]]<br />
 Access control system using serial main controller and intelligent readers
 *Serial controllers with terminal servers. In spite of the rapid development and increasing use of computer networks, access control manufacturers remained conservative, and did not rush to introduce network-enabled products. When pressed for solutions with network connectivity, many chose the option requiring less efforts: addition of a terminal server, a device that converts serial data for transmission via LAN or WAN.
@@ Line 77: / Line 81: @@
 [[File:Access control systems using serial controllers and terminal servers.png|300px|Access control systems using serial controllers and terminal servers]]<br />
 Access control systems using serial controllers and terminal servers
 *Network-enabled main controllers. The topology is nearly the same as described in the second and third paragraphs. The same advantages and disadvantages apply, but the on-board network interface offers a couple of valuable improvements. Transmission of configuration and user data to the main controllers is faster, and may be done in parallel. This makes the system more responsive, and does not interrupt normal operations. No special hardware is required in order to achieve redundant host PC setup: in the case that the primary host PC fails, the secondary host PC may start polling network controllers. The disadvantages introduced by terminal servers (listed in the fourth paragraph) are also eliminated.
@@ Line 82: / Line 87: @@
 [[File:Access control system using network-enabled main controllers.png|300px|Access control system using network-enabled main controllers]]<br />
 Access control system using network-enabled main controllers
 *IP controllers. Controllers are connected to a host PC via Ethernet LAN or WAN.
@@ Line 100: / Line 106: @@
 [[File:Access control system using IP controllers.png|300px|Access control system using IP controllers]]<br />
 Access control system using IP controllers
 *IP readers. Readers are connected to a host PC via Ethernet LAN or WAN.
@@ Line 117: / Line 124: @@
-'''Components of access control<ref>What are the components of access control? [https://www.upguard.com/blog/access-control Upguard]</ref>'''<br />
+'''Components of Access Control<ref>What are the components of access control? [https://www.upguard.com/blog/access-control Upguard]</ref>'''<br />
 At a high level, access control is about restricting access to a resource. Any access control system, whether physical or logical, has five main components:
 *Authentication: The act of proving an assertion, such as the identity of a person or computer user. It might involve validating personal identity documents, verifying the authenticity of a [[Website|website]] with a digital certificate, or checking login credentials against stored details.

← Older revision		Revision as of 20:10, 17 February 2021
Line 124:		Line 124:
	*Manage: Managing an access control system includes adding and removing authentication and authorization of users or systems. Some systems will sync with G Suite or Azure Active Directory, streamlining the management process.		*Manage: Managing an access control system includes adding and removing authentication and authorization of users or systems. Some systems will sync with G Suite or Azure Active Directory, streamlining the management process.
	*Audit: Frequently used as part of access control to enforce the principle of least privilege. Over time, users can end up with access they no longer need, e.g. when they change roles. Regular audits minimize this [[Risk\|risk]].		*Audit: Frequently used as part of access control to enforce the principle of least privilege. Over time, users can end up with access they no longer need, e.g. when they change roles. Regular audits minimize this [[Risk\|risk]].
		+
		+
		+	===References===
		+	<references/>

← Older revision		Revision as of 18:40, 17 February 2021
Line 115:		Line 115:
	[[File:Access control system using IP readers.png\|300px\|Access control system using IP readers]]<br />		[[File:Access control system using IP readers.png\|300px\|Access control system using IP readers]]<br />
	Access control system using IP readers		Access control system using IP readers
		+
		+
		+	'''Components of access control<ref>What are the components of access control? [https://www.upguard.com/blog/access-control Upguard]</ref>'''<br />
		+	At a high level, access control is about restricting access to a resource. Any access control system, whether physical or logical, has five main components:
		+	*Authentication: The act of proving an assertion, such as the identity of a person or computer user. It might involve validating personal identity documents, verifying the authenticity of a [[Website\|website]] with a digital certificate, or checking login credentials against stored details.
		+	*Authorization: The function of specifying access rights or privileges to resources. For example, [[Human Resources\|human resources]] staff are normally authorized to access [[Employee\|employee]] records and this [[Policy\|policy]] is usually formalized as access control rules in a [[Computer\|computer]] system.
		+	*Access: Once authenticated and authorized, the person or computer can access the resource.
		+	*Manage: Managing an access control system includes adding and removing authentication and authorization of users or systems. Some systems will sync with G Suite or Azure Active Directory, streamlining the management process.
		+	*Audit: Frequently used as part of access control to enforce the principle of least privilege. Over time, users can end up with access they no longer need, e.g. when they change roles. Regular audits minimize this [[Risk\|risk]].

@@ Line 43: / Line 43: @@
 ***Operation of the system is highly dependent on the host PC. In the case that the host PC fails, events from controllers are not retrieved, and functions that require interaction between controllers (i.e. anti-passback) stop working.
-[[File:Access Control Using Serial Controllers.png|300px|thumb|right|Access control system using serial controllers]]<br />
+[[File:Access Control Using Serial Controllers.png|300px|Access control system using serial controllers]]<br />
 *Serial main and sub-controllers. All door hardware is connected to sub-controllers (a.k.a. door controllers or door interfaces). Sub-controllers usually do not make access decisions, and instead forward all requests to the main controllers. Main controllers usually support from 16 to 32 sub-controllers.
@@ Line 56: / Line 57: @@
 ***All other RS-485-related disadvantages listed in the first paragraph apply.
-[[File:Access control system using serial main and sub-controllers.png|300px|thumb|right|Access control system using serial main and sub-controllers]]<br />
+[[File:Access control system using serial main and sub-controllers.png|300px|Access control system using serial main and sub-controllers]]<br />
 *Serial main controllers & intelligent readers. All door hardware is connected directly to intelligent or semi-intelligent readers. Readers usually do not make access decisions, and forward all requests to the main controller. Only if the connection to the main controller is unavailable, will the readers use their internal database to make access decisions and record events. Semi-intelligent reader that have no database and cannot function without the main controller should be used only in areas that do not require high security. Main controllers usually support from 16 to 64 readers. All advantages and disadvantages are the same as the ones listed in the second paragraph.
-[[File:Access control system using serial main controller and intelligent readers.png|300px|thumb|right|Access control system using serial main controller and intelligent readers]]<br />
+[[File:Access control system using serial main controller and intelligent readers.png|300px|Access control system using serial main controller and intelligent readers]]<br />
 *Serial controllers with terminal servers. In spite of the rapid development and increasing use of computer networks, access control manufacturers remained conservative, and did not rush to introduce network-enabled products. When pressed for solutions with network connectivity, many chose the option requiring less efforts: addition of a terminal server, a device that converts serial data for transmission via LAN or WAN.
@@ Line 72: / Line 75: @@
 ***All the RS-485-related advantages and disadvantages also apply.
-[[File:Access control systems using serial controllers and terminal servers.png|300px|thumb|right|Access control systems using serial controllers and terminal servers]]<br />
+[[File:Access control systems using serial controllers and terminal servers.png|300px|Access control systems using serial controllers and terminal servers]]<br />
 *Network-enabled main controllers. The topology is nearly the same as described in the second and third paragraphs. The same advantages and disadvantages apply, but the on-board network interface offers a couple of valuable improvements. Transmission of configuration and user data to the main controllers is faster, and may be done in parallel. This makes the system more responsive, and does not interrupt normal operations. No special hardware is required in order to achieve redundant host PC setup: in the case that the primary host PC fails, the secondary host PC may start polling network controllers. The disadvantages introduced by terminal servers (listed in the fourth paragraph) are also eliminated.
-[[File:Access control system using network-enabled main controllers.png|300px|thumb|right|Access control system using network-enabled main controllers]]<br />
+[[File:Access control system using network-enabled main controllers.png|300px|Access control system using network-enabled main controllers]]<br />
 *IP controllers. Controllers are connected to a host PC via Ethernet LAN or WAN.
@@ Line 93: / Line 98: @@
 ***Operation of the system is dependent on the host PC. In case the host PC fails, events from controllers are not retrieved and functions that require interaction between controllers (i.e. anti-passback) stop working. Some controllers, however, have a peer-to-peer communication option in order to reduce dependency on the host PC.
-[[File:Access control system using IP controllers.png|300px|thumb|right|Access control system using IP controllers]]<br />
+[[File:Access control system using IP controllers.png|300px|Access control system using IP controllers]]<br />
 *IP readers. Readers are connected to a host PC via Ethernet LAN or WAN.
@@ Line 106: / Line 112: @@
 ***Being more sophisticated than basic readers, IP readers are also more expensive and sensitive, therefore they should not be installed outdoors in areas with harsh weather conditions, or high probability of vandalism, unless specifically designed for exterior installation. A few manufacturers make such models.
 ***The advantages and disadvantages of IP controllers apply to the IP readers as well.
 [[File:Access control system using IP readers.png|300px|Access control system using IP readers]]<br />

@@ Line 18: / Line 18: @@
-'''Types of access control<ref>4 Types of access control [https://www.csoonline.com/article/3251714/what-is-access-control-a-key-component-of-data-security.html CSO]</ref'''><br />
+'''Types of access control<ref>4 Types of access control [https://www.csoonline.com/article/3251714/what-is-access-control-a-key-component-of-data-security.html CSO]</ref>'''<br />
 Organizations must determine the appropriate access control model to adopt based on the type and sensitivity of data they’re processing. Older access models include discretionary access control (DAC) and mandatory access control (MAC), role based access control (RBAC) is the most common model today, and the most recent model is known as attribute based access control (ABAC).
 *Discretionary access control (DAC): With DAC models, the data owner decides on access. DAC is a means of assigning access rights based on rules that users specify.
@@ Line 28: / Line 28: @@
 '''Access Control System Topologies<ref>Access Control System Topologies [https://en.wikipedia.org/wiki/Access_control Wikipedia]</ref>'''<br />
 *Serial controllers. Controllers are connected to a host PC via a serial RS-485 communication line (or via 20mA current loop in some older systems). External RS-232/485 converters or internal RS-485 cards have to be installed, as standard PCs do not have RS-485 communication ports.
 **Advantages:
@@ Line 44: / Line 43: @@
 ***Operation of the system is highly dependent on the host PC. In the case that the host PC fails, events from controllers are not retrieved, and functions that require interaction between controllers (i.e. anti-passback) stop working.
-[[File:Access control system using serial main and sub-controllers.png|300px|thumb|right|Access control system using serial main and sub-controllers]]<br />
+[[File:Access Control Using Serial Controllers.png|300px|thumb|right|Access control system using serial controllers]]<br />
 *Serial main and sub-controllers. All door hardware is connected to sub-controllers (a.k.a. door controllers or door interfaces). Sub-controllers usually do not make access decisions, and instead forward all requests to the main controllers. Main controllers usually support from 16 to 32 sub-controllers.
 **Advantages:
@@ Line 55: / Line 55: @@
 ***Main controllers tend to be expensive, therefore such a topology is not very well suited for systems with multiple remote locations that have only a few doors.
 ***All other RS-485-related disadvantages listed in the first paragraph apply.
 [[File:Access control system using serial main controller and intelligent readers.png|300px|thumb|right|Access control system using serial main controller and intelligent readers]]<br />
 *Serial controllers with terminal servers. In spite of the rapid development and increasing use of computer networks, access control manufacturers remained conservative, and did not rush to introduce network-enabled products. When pressed for solutions with network connectivity, many chose the option requiring less efforts: addition of a terminal server, a device that converts serial data for transmission via LAN or WAN.
 **Advantages:
@@ Line 69: / Line 71: @@
 ***Serial communication link between the controller and the terminal server acts as a bottleneck: even though the data between the host PC and the terminal server travels at the 10/100/1000Mbit/sec network speed, it must slow down to the serial speed of 112.5 kbit/sec or less. There are also additional delays introduced in the process of conversion between serial and network data.
 ***All the RS-485-related advantages and disadvantages also apply.
 [[File:Access control system using network-enabled main controllers.png|300px|thumb|right|Access control system using network-enabled main controllers]]<br />
 *IP controllers. Controllers are connected to a host PC via Ethernet LAN or WAN.
 **Advantages:
@@ Line 89: / Line 93: @@
 ***Operation of the system is dependent on the host PC. In case the host PC fails, events from controllers are not retrieved and functions that require interaction between controllers (i.e. anti-passback) stop working. Some controllers, however, have a peer-to-peer communication option in order to reduce dependency on the host PC.
-[[File:Access control system using IP readers.png|300px|thumb|right|Access control system using IP readers]]<br />
+[[File:Access control system using IP controllers.png|300px|thumb|right|Access control system using IP controllers]]<br />
 *IP readers. Readers are connected to a host PC via Ethernet LAN or WAN.
 **Advantages:
@@ Line 101: / Line 106: @@
 ***Being more sophisticated than basic readers, IP readers are also more expensive and sensitive, therefore they should not be installed outdoors in areas with harsh weather conditions, or high probability of vandalism, unless specifically designed for exterior installation. A few manufacturers make such models.
 ***The advantages and disadvantages of IP controllers apply to the IP readers as well.