4.3.2. Permissions, Access Controls, and Auditing
💡 First Principle: Access controls define what authenticated users can do. The goal is matching permissions to job function—users have exactly what they need and nothing more. When access is too broad, attackers who compromise a user account inherit that user's excess permissions.
Access Control Models
| Model | How Permissions Are Assigned | Example |
|---|---|---|
| Role-based (RBAC) | Permissions assigned to roles; users assigned to roles | "Database Admin" role has specific DB permissions; users added to that role |
| Rule-based | Permissions determined by rules/conditions | Firewall rules (allow traffic from 10.0.0.0/8 on port 443) |
| Scope-based | Access limited to defined scope | A service account can only access files in C:\App\Data\ |
Permissions in Practice (NTFS example)
NTFS permissions: Full Control, Modify, Read & Execute, Read, Write. Best practice:
- Assign permissions to groups, not individual users
- Use the least permissive combination that allows the required task
- Document what permissions exist and why
Segregation of Duties
No single person should have complete control over a critical process. Example: the person who creates purchase orders should not be the same person who approves them. In IT: the admin who deploys code should not be the same person who approves deployments. This limits fraud and reduces error impact.
Delegation
Delegation allows a user to perform specific administrative tasks without full admin rights. Example: delegating password reset rights to a help desk team without giving them full AD admin access.
Auditing
Auditing records access events for accountability and forensic investigation:
- User activity: What did this user do? When?
- Logins: Successful and failed authentication attempts. Failed logins from a single account can indicate a brute force attack; failed logins from many accounts can indicate a password spray attack.
- Group memberships: Who was added to or removed from privileged groups?
- Deletions: What files or objects were deleted? By whom?
Audit logs are only useful if they're monitored and retained. Unmonitored logs provide no real-time protection; short retention limits forensic capability.
⚠️ Exam Trap: Auditing is not the same as access control. Auditing records what happened; it doesn't prevent it from happening. You need both: access controls to prevent unauthorized actions and auditing to detect and investigate what does occur.
Reflection Question: An administrator grants the "Everyone" group Full Control on a file share for convenience. What is wrong with this, and what access control model and principle does it violate?
