Access controls are often regarded as the first line of defense in safeguarding assets. They govern how subjects access objects, and their primary purpose is to protect the assets from unauthorized access. Access control models are frameworks that use access restrictions to implement the model's rules and goals.
Access control models (Harris & Maymi, 2021, p. 776)
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC)
Rule-Based Access Control (RB-RBAC)
Attribute-Based Access Control (ABAC)
Risk-Based Access Control (Risk BAC)
Why access control is needed (Piras, 2021)
Access control systems defend against data theft, cyberattacks, and privacy breaches.
Access control can restrict who or what can see or use a specific document, asset, or resource.
The primary objective of an access control system is to offer a degree of security that reduces business risk.
Frustrations employees may feel with access control while remote working
Employees will have access to fewer organizational assets compared to working at the office
Having lesser amounts of access to assets will inevitably slow down work
Employee requests for more access will require more scrutiny
Why turning off access control while remote working is not an acceptable risk
Remote work is insecure by nature, so taking extra precautions to restrict access is the only way to reasonable secure organizational assets from threat actors
Without access control, the organization's assets are reachable by the entire internet
Access control is the primary way to ensure only authorized people can access objects; there are no alternatives that provide similar protection
Potential for insider threats (Cyolo, 2022)
Maintaining the same level of cybersecurity for remote workers is much more complex than for office workers
Unsecured personal devices are more likely to enable security breaches
Remote workers do not have the protection of the organization's firewall, data loss prevention (DLP), and security information and event manager (SIEM)
References
Cyolo. (2022, April 4). Why remote work increases the risk of insider threats. https://cyolo.io/blog/why-remote-work-increases-the-risk-of-insider-threats/
Harris, S., & Maymi, F. (2021). CISSP all-in-One exam guide (9th ed.). McGraw-Hill Education.
Piras, M. (2021, October 15). What is an access control system, and why do you need it? Nira. https://nira.com/what-is-access-control