Access Control

In every larger computer system, many people work with the same data. But not everyone should be allowed to see or change everything. Access control is the technology that regulates exactly that. It answers two questions in sequence: Who are you? And what are you allowed to do with it? The first question is clarified by a login process, such as with a password or fingerprint. The second question is answered by a stored list of rights associated with your account.

What happens when rights are granted too broadly

Most major data breaches are not caused by brilliant hackers. They occur because someone had access to data that was none of their business. An intern with full administrative rights, a database left on the internet without a password, an old employee account that no one deleted: such cases regularly appear in the business news. The damage ranges from fines to a loss of customer trust.

That is why security technology follows the principle of least privilege. Everyone gets exactly as many permissions as they need for their work, and not a single one more. This sounds self-evident, but it is inconvenient in everyday practice. Requesting rights takes time, so they tend to be granted generously, and people forget to revoke them later. Over the years, employees thus accumulate permissions that no one keeps track of anymore.

In Europe, there is additional legal pressure. The General Data Protection Regulation requires companies to protect personal data from unauthorized access. Anyone who cannot prove that only authorized individuals can access customer data risks severe penalties. Access control is therefore not just a technical issue, but also a legal one.

Roles, rules, and the bouncer principle

You can imagine access control as a bouncer standing in front of every single room in a building. He first checks your ID. Then he looks at a list to see whether your name is registered for this room. The first step is called authentication, the second authorization. The two are often confused, but they are clearly distinct: a correctly logged-in user may still be allowed to do almost nothing.

Maintaining rights individually for each person would be impossible with thousands of employees. That is why roles are usually used instead. A role such as “accounting” or “support” bundles a fixed set of rights. New employees are assigned a role and thereby inherit all the matching permissions. When someone changes departments, the role is swapped out. This procedure is called role-based access control.

More modern systems go a step further and make decisions based on attributes. Then time of day, location, or device factor into the decision. Access to salary data at three in the morning from a foreign country is blocked, while the same access from the office is permitted. Also important is logging: the system records who accessed what and when. Without such logs, it is impossible to reconstruct what happened after an incident.

From the school cloud to the AI chatbot at the company

You already encounter this concept in everyday life, usually without it being named. In a school cloud, you see your own grades, but not those of your classmates. On a shared document, part of the group may write, another part may only read. Your phone asks whether an app may access the camera and contacts. All of this is access control.

The topic is especially current with AI systems in companies. A chatbot that answers questions about internal documents must respect the rights of the person asking. Otherwise, it might tell an intern something from the boss’s personnel file. Experts call this a backdoor leak: the file itself was protected, but its content leaked out through the AI’s answer. Providers therefore explicitly advertise that their systems adopt existing permissions.

In stock market and tech news, the term usually appears in two contexts. Either an access control has failed and data has leaked out. Or a company acquires a provider of identity and access management, because this market has been growing for years. A related buzzword is Zero Trust: the stance of never automatically trusting any access, not even from within the company’s own network.