Access Control

Once a user has been authenticated, the next step is to ensure that they

can only access the information resources that are appropriate. This is

done through the use of access control. Access control determines which

users are authorized to read, modify, add, and/or delete information.

Several different access control models exist. Here we will discuss two:

the access control list (ACL) and role‐based access control (RBAC).

For each information resource that an organization wishes to manage, a

list of users who have the ability to take specific actions can be created.

This is an access control list, or ACL. For each user, specific capabilities

are assigned, such as read, write, delete, or add. Only users with those

capabilities are allowed to perform those functions. If a user is not on the

list, they have no ability to even know that the information resource

exists.