Access Control

Go up to Terms and Definitions

Access Control regulates interactions between a subject and a protected resource according to an applicable Policy.

A subject includes a person, organisation, process, service, system, device, or Node. A resource includes information, an artifact, a service, an interface, a function, a system, a physical location, or another controlled object.

An access-control decision evaluates the subject, requested action, protected resource, applicable policy, environmental conditions, and other relevant attributes. The decision grants, denies, limits, or terminates the requested access.

Authentication commonly supplies verified identity or attribute information used in an access-control decision. Authentication remains distinct from Access Control. Authentication evaluates a claim. Access Control determines whether the applicable policy permits the requested interaction.

process that grants, denies, restricts, or terminates access to a resource according to an applicable policy

Adapted from ISO/IEC 27000, Information security, cybersecurity and privacy protection — Vocabulary.

Access Control includes administrative, physical, and technical controls.

An access-control policy identifies the subjects, resources, permitted actions, prohibited actions, conditions, exceptions, decision authorities, and enforcement points within its scope.

Access-control records support Auditability, Evidence, and Traceability by recording access requests, decisions, enforcement actions, and relevant context.

An access-control policy permits a Test Execution process to read an identified Credential from a secret store while denying direct access to the Credential value by test operators.