More than ever, the way we work needs to be flexible. There are companies that have several employees or all of them working from home or location. There are also workgroups that perform their tasks both in an office and from any location. However, we need to take care of who needs to access both data and system resources. Cyber security threats are often overlooked by SMBs, thinking “they’re not big enough” to be an actual target. It is important to get back in control and defend your small business from cyber attacks through minimazing access risk!
Access Control Systems for small businesses are a core component of data security that manage and control access to IT resources and data. In order to comply with data protection requirements such as those of the General Data Protection Regulation (GDPR), access control is indispensable.
It is usually used in combination with other security measures. Access control systems can be used to ensure that only authorized persons in a computing environment can access certain data or use certain resources.
Access control is a basis for the integrity, confidentiality and availability of data. Measures to control and manage access can be of an organizational and technical nature and include authentication, authorization and the use of access control policies.
Identity Management = Access Management?
Identity management confirms that you are you and stores information about you. An Identity Management database contains information about your identity – for example, your job title and direct supervisors – and confirms that you are indeed the person described in the database.
Access Management uses the information about your identity to determine which software suites you are allowed to access and what you are allowed to do when you do. For example, Access Management ensures that any manager with direct subordinates has access to a timesheet approval application, but not so much access that they can approve their own timesheets. There’s a remarkable increase in the use of Access Management methods around the globe which seems quite logical, considering the high cyber risk small businesses are opposed to.
Both are used together in so-called IAM systems or as an IAM strategy.
In this article we show you all your options regarding Access Control Systems for small business, explain the pros and cons of each type and hopefully help you make the right decision when it comes to picking one (or more) Access Control methods!
How do Access Control Systems work?
Access Control Systems identify users by verifying various credentials, such as usernames and passwords, PINs, biometrics, and security tokens. Many access control systems also use multi-factor authentication (MFA), a combination of multiple authentication methods to confirm identity.
Access control systems perform authorization, authentication and, of course, access approval and take care of responsibilities of the corresponding entities. Credentials are used for this purpose, which include passwords, personal identification numbers (PINs), biometric scans, and physical or electronic keys.
There are five main types of access control:
-
- Discreationary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC)
- Rule-Based Access Control (RuBAC)
- Attribute-Based Access Control (ABAC)
Let’s go through the different Control Access Systems for small businesses together. We’ll explain how they work, talk about advantages and disadvantages, and give you examples so that at the end of our article you can use our summary to make the best decision for your company.
The 5 types of Access Control
Discretionary Access Control (DAC)
In this Access Control System, the owner or administrator of the protected system, data or resources determines the access policies. For each object O created by user A, user A is automatically the owner of this object. User A, as the owner of the object, may now alone decide which access rights (e.g. read/write) other users X are granted to his object O. So DAC is an access control where access rights are defined per user. Whether a user X is granted access to the object O is decided only on the basis of the identity of the user X.
Example:
User X creates a table locally on his/her computer and may alone decide who gets it, i.e. who may see and modify it. He/She can decide for each user on their computer individually at his/her discretion whether the other user may only see the table, not see it at all, or also change it. Most common use for this in a work area is when sharing Google Workspace documents with other employees / the client.
Mandatory Access Control (MAC)
In this mandatory model, access is distributed only on the basis of clearance levels. Access rights are governed by a central authority based on the individual clearance levels. This model is often used in government and military installations.
First, a classification is defined by the system administrator for each object O. Typical security levels are, for example, unclassified, confidential, secret or top secret. In addition to this, an authorization is defined for each user X (also called: clearance). No user X can make changes to his own clearance. As can be seen, decisions are made here not only purely on the basis of the identity of the accessing party, as with DAC, but also on the basis of the properties (classification/authorization).
Example:
One can create a new object O in a multi-level system with the clearance of “top secret”, which receives the label “secret” from the admin. All users X who only have a clearance of “unclassified” or “confidential” cannot see the object O, let alone open it.
Role-Based Access Control (RBAC)
RBAC grants access based on predefined roles in the organization rather than the identity of individual users. Users should only be granted access to the data they need to perform their job. This widely used method is based on a complex combination of role assignments, authorizations and permissions.
With an increasing number of users, the administration of their respective explicit rights quickly becomes complex and confusing; therefore error-prone. To counteract this, the summary and categorization of rights is used on the basis of abstracted work processes. This means that a user is assigned one or more so-called user roles, which “inherit” their rights to the individual user. It stands to reason that employees from the HR department, for example, should not have the right to configure the network or server.
Example:
On a network drive accessible to all users, there are individual folders for: Executive Board, IT Administration and Advertising. While the Executive Board folder can only be accessed by people in management (these people have the Management role), working students can only access the Advertising folder (as they have the Working Students role).
Rule-Based Access Control (RUBEC)
Behind this type of Access Control System stands an access or a decision based on properties. Rules then allow or deny access. In this system, permissions are granted based on set rules and policies. When a user tries to gain access to a resource, the operating system checks the rules defined in the “Access Control List” for each resource. Creating the rules, policies and associated context takes time and work. This method is often used together with a role-based approach.
Example:
Students are only allowed to use the lab for experiments on certain days at certain times.
Attribute-Based Access Control (ABAC)
In this dynamic method, access is based on a set of attributes and environmental conditions, such as time and location, that are assigned to both users and resources.
Access to an object is granted or not granted not only with the help of a role or explicit assignment of rights, but rather on the basis of several attributes such as a combination of user, client, another resource and/or a system state. The actor thus needs several attributes/elements to identify itself to the system as authorized for access.
Examples for Attributes that can be mapped from the source system:
- Name
- Department
- Position
- Supervisor of the employee
- Location
- Date of start and end of contract
- And almost any other variable
VPN – the tool for Access Control
A popular tool for controlling information access is a virtual private network (VPN). A VPN is a service that allows a remote user to access the Internet as if they were connected to a private network. Enterprise networks often use VPNs to control access to their internal network across a geographical distance.
A suitable VPN application ensures that the data can no longer be read by unauthorized persons. In addition, it enables access to drives that are located on the company’s own server and should only be available within the company network. Without VPN, therefore, even centrally stored documents cannot be processed.
Find the Access Control System for your small business
ABAC vs. RBAC
ABAC allows attributes to be customized to a user’s needs without having to create a new role for them. While with RBAC a user typically falls into a role defined by their job title, with ABAC numerous attributes can be applied individually to a user or object. Each attribute can condition a differentiated set of permissions. With these features, ABAC is a much more granular system than the role-based access control model.
Attribute-based access control provides organizations with dynamic, contextual provisioning and access management. ABAC models allow management to be extended beyond narrowly defined roles. This results in more accurate provisioning and reduced effort in managing access to required resources that fall outside of the normal user role configuration.
To sum it up:
As you can see, ABAC’s strength lies in its rich and granular management capabilities that allow flexible provisioning of accounts and entitlements to users according to their unique attributes. Role-specific permissions via an RBAC model often aren’t enough for real users after all, and require regular configuration updates to rules or ad hoc provisioning (and associated service desk tickets that unnecessarily increase IT workload). An ABAC model, on the other hand, enables user-specific authorization assignment based on the individual attributes of each employee across your organization.
MAC vs. DAC
The main difference between DAC and MAC is that DAC is an access control method where the owner of the resource determines access, while MAC is an access control method that allows access to the resource depending on the user’s sharing level.
On the one hand, MAC can get quite complicated quite fast (if you have 100 users in your company, you need to make 100 different roles and permissions in the system in order to use MAC…), but nevertheless it has to be said that of all access controls MAC is the most robust (because the simplest). So if you can do without flexibility, MAC can be a good choice.
DAC on the other hand brings numerous advantages:
- hardly any administrative obligations
- flexible, customizable
- role management is very simple
- low costs
- However, the disadvantage of DAC is that it does not perform as well as MAC in terms of security and is therefore more susceptible to cyberattacks.
To sum it up:
MAC and DAC can be a good choice for you, depending on whether you want flexibility in access management and integrability or whether you want security and cost savings for your enterprise.
Overview
If your head is spinning now, that’s perfectly normal. To ease your mind and to help you make the best possible decision, we have summarized the most important features of Access Control Systems for small businesses in the following table:
| DAC | MAC | RBAC | RuBAC | ABAC | |
| Access Control to Information | through owner of data | through rules | through roles | through rules | through attributes |
| Access Control based on | discretion of the data’s owner | classification of users and data | classification of roles | classification of rules | evaluation attributes |
| Flexibility for processing information | high | low | high | high | very high |
| Access revocation complexity | complex | easy | easy | easy | easy |
| Support for Multilevel Database Systems | no | yes | yes | yes | yes |
Choose the best option
The choice of the right Access Control System for small businesses is usually based on the organization’s individual security and compliance requirements.
To ensure that data is better protected and a higher level of security is maintained, you must do one thing above all else: devise the appropriate access control policies. No matter what access control you end up choosing, it won’t work without cyber awareness, setting the right priorities and defining access control policies. Each policy must apply to all roles, applications, databases and employees in the organization.
An Access Control Strategy consists of a set of rules on which the system’s access control decision of the system is based. A security strategy should be formulated as precisely as possible to achieve a high quality standard for the security of the system.
Now that we’ve shown you the 5 types of access control, it’s up to you to decide. To help you decide, consider the following:
Do you have a large company with many responsibilities where security is the top priority?
Then use ABAC, RBAC, RuBAC or MAC.
Do you have a small company with fewer roles and users?
Then use DAC or MAC, because they are easier to integrate.
Do you have a company working with particularly sensitive data?
Then simply use multiple systems: for example, use RBAC and build RuBAC on top of it to ensure the highest possible security.
If you want to dive deeper into how to build an effective cyber resilience, you could start by following these steps.
If you want to be on the safe side and take advantage of all the possibilities regarding Access Control Systems for small businesses to strengthen your defenses against attacks or to bring your asset management to the best possible condition, then contact us, because our software TheFence – using Role-Based Access Control – maximizes your security and helps you to get a bombproof protection against all kinds of cyber attacks.
