Identity & Access Management

Access control governs access to information, systems, devices, facilities, applications, and services — both logical and physical resources.

Logical (technical) controls restrict access to data and systems via software (passwords, ACLs, encryption); physical controls restrict access to facilities and hardware (locks, guards, badges). They should be integrated for defense in depth.

Integration provides defense in depth — a badge swipe (physical) combined with a network login (logical) ensures layered protection so a breach of one layer does not grant full access.

A subject is the active entity (user, process, program) that requests access; an object is the passive resource (file, database, device) being accessed.

A table whose rows are subjects and columns are objects; each cell lists the permissions a subject has for an object. It is the conceptual model decomposed into ACLs (by column) or capability tables (by row).

A capability table is bound to a SUBJECT and lists the objects/permissions that subject holds (a matrix row). An ACL is bound to an OBJECT and lists the subjects/permissions for that object (a matrix column).