Access Control: Protecting Unauthorized Use of LAN Resources

Local Area Networks (LANs) connect computers and devices within limited geographic areas like offices, schools, and homes. While LANs facilitate seamless communication and resource sharing, they also create potential security vulnerabilities. Access control serves as the first line of defense against unauthorized use of network resources, determining who can access what and under which conditions.

What is access control in LAN security? 🔗

Access control is the combination of policies and technologies that regulate which users or systems can access specific network resources. In a LAN environment, access control decides which authenticated users may access which resources based on predefined security policies. This prevents unauthorized users from accessing sensitive data, modifying critical files, or disrupting network operations.

The core objective of access control is straightforward: ensure that only authorized individuals can access network resources while maintaining the confidentiality, integrity, and availability of data. Without proper access control mechanisms, any device connected to the LAN could potentially access all network resources, creating significant security risks.

Discretionary access control (DAC) 🔗

Discretionary Access Control allows the owner of a resource to decide who can access it and what permissions they receive. This model is widely used in corporate environments where flexibility and collaboration are essential.

How DAC works 🔗

In DAC systems, resource owners or administrators assign permissions to users or groups. When you share a folder on your computer and grant specific users read or write access, you’re using discretionary access control. The controls are discretionary in the sense that a subject with a certain access permission is capable of passing that permission to any other subject.

DAC implementations commonly use access control lists (ACLs) to manage permissions. Each resource maintains a list of users and groups along with their corresponding access rights such as read, write, or execute.

Advantages and limitations of DAC 🔗

The primary advantage of DAC is its flexibility. Resource owners can adjust access as their needs change, making it ideal for dynamic business environments. Implementation is straightforward, and users find the model intuitive and easy to understand.

However, this flexibility comes with security trade-offs. Owner discretion increases the risk of unauthorized access, as users might inadvertently grant excessive permissions. Security administrators also have limited visibility into how resources are shared across the organization, potentially creating security gaps.

Mandatory access control (MAC) 🔗

Mandatory access control uses a centrally managed model to provide the highest level of security. Unlike DAC, MAC doesn’t allow individual users to modify access policies, making it a non-discretionary system.

How MAC operates 🔗

MAC relies on security labels assigned to both resources and users. These labels typically include two components: classification levels and compartments. Users’ security clearances determine what kinds of resources they may access, while compartments define which groups can access specific resources.

Access is granted only when a user’s security label matches the resource’s security label. The Trusted Computer System Evaluation Criteria defined MAC as a means of restricting access to objects based on the sensitivity of the information contained in the objects and the formal authorization of subjects to access information of such sensitivity.

Applications and considerations 🔗

MAC originated in military and government environments where data confidentiality is paramount. Banks and insurers, for example, may use MAC to control access to customer account data when they require stringent security controls.

While MAC offers superior security, it presents implementation challenges. The rigid structure demands dedicated administrative resources to manage security labels and policies. Organizations must also balance security requirements against user productivity, as overly restrictive policies can hinder legitimate work activities.

Access granularity: owner, group, and world 🔗

Access control systems often organize permissions into three categories: owner, group, and world. This granularity model, familiar from Unix-based systems, provides a simple yet effective way to manage access rights.

The owner typically has full control over the resource, including the ability to read, write, modify, and delete it. Group permissions apply to a defined set of users who share common access needs, such as members of a department or project team. World permissions, sometimes called “others,” apply to all users on the system who don’t fall into the owner or group categories.

Unix file mode represents write, read, and execute in each of the 3 bits for User, Group and Others, creating a straightforward permission structure that balances security with usability.

Access control lists (ACLs) 🔗

An access-control list is a list of permissions associated with a system resource. ACLs specify which users or system processes can access resources and what operations they’re allowed to perform.

Structure and function 🔗

Each ACL contains access control entries (ACEs) that pair users or groups with their access privileges. The most common privileges for a file system ACL include the ability to read a file, to write to the file, and to execute the file if it is an executable file or program.

ACLs operate at both the filesystem and network levels. Filesystem ACLs control access to files and directories, while networking ACLs manage which traffic can access network resources, functioning similarly to firewalls.

Benefits and challenges 🔗

ACLs provide fine-grained control over resource access and are relatively simple to understand. They allow administrators to specify exactly which users can perform which operations on each resource.

However, managing ACLs can become complex in large environments. Administrators must maintain separate lists for each resource, and determining all permissions for a single user requires examining multiple ACLs across the system.

Capability lists 🔗

While ACLs are object-centric, capability lists take a subject-centric approach to access control. A capability can be given as a pair where x is the name of an object and r is a set of privileges or rights.

In a capability-based system, each user or process holds a list of capabilities specifying which resources they can access and what operations they can perform. Think of capabilities as unforgeable tickets that grant specific access rights.

Unlike capability lists, ACLs allow users to stop worrying about authentication because the system handles verification. However, capability lists can be more efficient for certain operations, as the system doesn’t need to search through resource-specific ACLs to determine a user’s permissions.

User profiles and privilege mechanisms 🔗

User profiles aggregate information about individual users, including their roles, group memberships, and access privileges. These profiles serve as the foundation for implementing access control policies across the network.

Modern access control systems use privilege mechanisms to assign and manage user rights. These mechanisms determine not just what resources users can access, but also what actions they can perform and under what conditions.

The principle of least privilege 🔗

The principle of least privilege requires that every module must be able to access only the information and resources that are necessary for its legitimate purpose. This fundamental security concept minimizes the potential damage from security breaches or user errors.

Implementation strategies 🔗

The principle works by limiting the accessible data, resources, applications and application functions to only that which a user or entity requires to execute their specific task. Users should receive permissions that enable them to perform their job functions, but nothing beyond that.

Implementing least privilege requires ongoing attention. Organizations must regularly review user permissions, remove unnecessary access rights, and ensure that privilege assignments reflect current job responsibilities. By imposing restrictions, the attack surface is reduced, minimizing the spread of breaches.

Benefits of least privilege 🔗

This approach delivers multiple security and operational advantages. It reduces the risk of accidental or intentional data breaches, as users cannot access resources beyond their scope of work. By limiting user access to only what is necessary, the principle reduces the potential damage if an account is compromised, since attackers cannot reach resources beyond that user’s assigned permissions.

Beyond security, least privilege improves system stability and compliance. Applications running with restricted rights have less ability to crash the entire system. Organizations also find it easier to demonstrate regulatory compliance when they can show that access controls follow established least privilege principles.

Implementing effective access control 🔗

Successful access control implementation requires careful planning and ongoing management. Organizations should start by identifying all network resources and determining appropriate access levels for different user roles. Regular audits help ensure that permissions remain aligned with business needs and security requirements.

Many organizations adopt hybrid approaches, combining elements of different access control models. For instance, they might use MAC for highly sensitive data while applying DAC to general business documents. Hybrid systems leverage the strengths of both models, offering enhanced security while maintaining flexibility for resource owners.

Technology alone cannot guarantee security. Organizations must also invest in user education, helping employees understand their role in maintaining network security. Clear policies, regular training, and accountability mechanisms work together with technical controls to protect LAN resources from unauthorized use.

What do you think? How does your organization balance security requirements with the need for user flexibility in accessing network resources? What challenges have you encountered when implementing access control mechanisms in LAN environments?

References

1. https://www.twingate.com/blog/other/access-control-models
2. https://www.pingidentity.com/en/resources/blog/post/access-control.html
3. https://en.wikipedia.org/wiki/Discretionary_access_control
4. https://en.wikipedia.org/wiki/Mandatory_access_control
5. https://en.wikipedia.org/wiki/Access-control_list
6. https://www.techtarget.com/searchnetworking/definition/access-control-list-ACL
7. https://www.geeksforgeeks.org/operating-systems/difference-between-access-control-list-and-capability-list/
8. https://identitymanagementinstitute.org/access-control-matrix-and-capability-list/
9. https://en.wikipedia.org/wiki/Principle_of_least_privilege
10. https://www.paloaltonetworks.com/cyberpedia/what-is-the-principle-of-least-privilege
11. https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/principle-of-least-privilege-polp/
12. https://www.cloudflare.com/learning/access-management/principle-of-least-privilege/