Access Control as a System

Access control systems are built using all three categories of security controls: administrative, physical, and technical (logical).

Administrative controls focus on the human-

From this design basis, security and systems professionals then choose the facing policies, directives, procedures, right mix of physical and logical or technical training and education programs, standards, controls. Publications from organizations, and compliance requirements. like the National Institute of Standards Administrative controls drive and Technology (NIST) and International the design of workflows and

Organization for Standardization (ISO), processes to ensure security emphasize the importance of policies and procedures alongside technical controls needs are met.

(devices and software) when addressing access control systems.

Physical access control systems guide, prevent, or permit the movement of users and devices within a defined space, as part of a systematic approach to security and risk management.

Logical access controls work within the data and information flows of the system itself.

The simplest example of a physical access control system is a door that can be locked, limiting people to one side of the door or the other.

The user login process demonstrates a logical control in operation: it takes the data flows generated or triggered by physical actions performed by the user (e.g., keystrokes and mouse movements) and processes that data to determine whether to grant or deny the user the permission to logically move to the next software-driven step they wish to perform.

A smart card, a physical entryway controller, Before selection and implementation of provides an example of a combination of the logical access control type, the data physical and logical controls. The card owner needs to classify and categorize their reader device on the door does not directly information. Each of these complementary operate the locks or the door release processes identifies the type of protection the system's designers and security mechanisms; instead, the data read from professionals need to provide and to what the card, and perhaps other data entered by extent, to meet the organization's overall the user, is sent over a network connection to an access control server. That server information risk management needs. This step must come first. Small- and mediumdetermines whether this specific access attempt should be granted, based on its sized enterprises often procrastinate when it comes to a risk-based approach to access stored rule base and other parameters. It then responds to the entryway controller control, thinking that it adds far too much with the commands to open the door, or to analysis time, effort, and cost; this does not deny entry and perhaps take other action. have to be the case. As part of its accounting function, the access control server makes a record of the attempt and its resultant decisions; the entryway controller makes a note in its own log files.