accesskontroll

Accesskontroll is the practice of determining whether a subject should be allowed to access a resource and under what conditions. It covers both physical security controls for buildings and rooms and logical controls for digital systems and data. The goal is to protect confidentiality, integrity, and availability by enforcing least privilege and need-to-know.

Core elements are identification, authentication, authorization, and accounting (the AAA model). Policies define who may access which resources, when, and how. Enforcement is carried out by devices and software such as door readers, firewalls, access gateways, and authorization rules.

Common models include ACLs (Access Control Lists), RBAC (Role-Based Access Control), ABAC (Attribute-Based Access Control), and MAC (Mandatory Access Control). ACLs assign permissions to individual subjects or groups; RBAC assigns permissions by role; ABAC uses attributes of subjects, resources, and environment.

Implementation blends physical systems (badges, biometrics, turnstiles) with digital identity and access management, including single sign-on and multi-factor authentication. Context-aware and dynamic access decisions may consider time, location, device posture, and risk.

Governance and assurance require regular reviews, separation of duties, strong auditing, and adherence to standards such as ISO/IEC 27001, ISO/IEC 27002, and NIST SP 800-53.

In practice, accesskontroll is a cross-disciplinary field spanning physical security, information security, and IT governance, and it is essential for protecting assets in organizations and public institutions.