Access control is a security technique that can be used to regulate who or what can view or use resources in a computing environment.
There are two main types of access control: physical and logical. Physical access control limits access to campuses, buildings, rooms and physical IT assets. Logical access limits connections to computer networks, system files and data.
The are four main categories of access control systems:
- Mandatory Access Control Systems
- Discretionary access control Systems
- Role-based access Control
- Rule-based access control
Access control systems perform authorization, identification, authentication, access approval, and accountability of entities through login credentials including passwords, personal identification numbers (PINs), biometrics scans, and physical or electronic keys.
Fundamentally, to set an effective approach to authorization the first question that you need to address is “what will we control access to?” As an I.T Solution firm, our experience is that you can secure access to both data and functionality, such as access to quarterly sales figures and the ability to fire another employee respectively. Your stakeholder’s requirements will drive the answer to this question. However, the granularity of access, and your ability to implement it effectively, is a significant constraint.
For example, although you may be asked to control access to specific columns of specific rows within a database based on complex business rules you may not be able to implement this in a cost effective manner that also conforms to performance constraints. That is where our speciality comes in.
Please note that authorization can be enforced within your database by a variety of means (which can be combined). These techniques include:
Permissions. A permission is a privilege, or authorization right, that a user or role has regarding an element (such as a column, table, or even the database itself). A permission defines the type of access that that is permitted, such as the ability to update a table or to run a stored procedure. With HRT, permissions are given via the GRANT command and removed via the REVOKE command. When a user attempts to interact with a database his or her permissions are checked, and if the user is not authorized to perform part of the interaction, which could be a transaction, the interaction fails and an error is returned.
Views. You can control, often to a very fine level, the data that a user can access via the use of views. This is a two-step process. First, you define views that restrict the tables, columns, and rows within the tables that a role can access. Second, you define permissions on those views.
Stored procedures. Code within the stored procedure can be written to programmatically check security access rules.
Proprietary approaches. A new option being offered by some database vendors is proprietary security tools. One example is Oracle Label Security, an add-on that enables you to define and enforce row-level permission..