Access Control
CIE A-Level Computer ScienceΒ· Unit 6: Security, privacy and data integrity, Topic 3Β· 15 min read
1. Core Concepts: Authentication vs Authorizationβ βββββ± 3 min
Access control is the process of restricting access to system resources to only approved entities. It relies on two sequential core steps that are regularly tested in CIE exams.
Authentication
The process of verifying that an entity (user, process, device) is who it claims to be
Example:
Checking that a password entered matches the stored hash for a given username
Authorization
The process of determining what permissions an already authenticated entity has to access or modify resources
Example:
Allowing a teacher to edit student grades but only letting students view their own grades
When a user logs into a bank's mobile app, which step is authentication and which is authorization? Step 1: User scans their fingerprint to log in. Step 2: User can only view their own account, not other customers' accounts.
- 1
Step 1 (fingerprint scan) verifies the user is the owner of the account, matching their claimed identity. This is authentication.
- 2
Step 2 restricts the user to only accessing their own account after successful login. This defines what the user can do, so it is authorization.
2. The Access Control Matrixβ β ββββ± 4 min
An access control matrix is a standard way to represent access permissions in a system, and is commonly tested in completion questions in CIE 9618.
Access Control Matrix
A tabular model where rows represent subjects (entities requesting access), columns represent objects (resources being accessed), and each cell stores the set of permitted access rights for that pair.
Subject | Read: Employee Handbook | Write: Employee Handbook | Read: Payroll | Write: Payroll |
|---|---|---|---|---|
Standard Employee | β | β | β | β |
HR Manager | β | β | β | β |
System Admin | β | β | β | β |
Create an access control matrix for a university system with 3 subjects: Student, Lecturer, Admin, and 3 objects: Lecture Notes, Coursework, Student Records. Permissions: Student can read Lecture Notes, write Coursework, no access to Student Records. Lecturer can read/write Lecture Notes, read Coursework, no access to Student Records. Admin has full access to all objects.
- 1
- Set up rows for the three subjects, and columns for the three objects, per standard convention.
- 2
- Populate the Student row: Lecture Notes = Read, Coursework = Write, Student Records = No access.
- 3
- Populate the Lecturer row: Lecture Notes = Read/Write, Coursework = Read, Student Records = No access.
- 4
- Populate the Admin row: all objects get Read/Write access to complete the matrix.
Exam tip:
Always remember: Rows = Subjects, Columns = Objects. Swapping these will lose marks in exam questions.
3. Core Access Control Modelsβ β β βββ± 5 min
CIE 9618 requires you to compare three core access control models, their properties, and appropriate use cases.
The table below compares the three key models:
Discretionary Access Control (DAC)
Access permissions are controlled by the owner of the resource, who can grant/revoke access to other users.
+ Pros: Flexible for small systems; Easy to implement
β Cons: No centralized control; High risk of accidental unauthorized access
Mandatory Access Control (MAC)
Access permissions are set by the system based on security labels for subjects and objects. Users cannot change permissions.
+ Pros: Very high security; Strict access enforcement
β Cons: Inflexible; Administratively expensive to maintain
Role-Based Access Control (RBAC)
Permissions are assigned to job roles, not individual users. Users are added to roles to inherit permissions.
+ Pros: Scalable for large organizations; Simplifies permission management; Aligned with job functions
β Cons: Risk of permission bloat; Not suitable for fine-grained access needs
A government department needs to control access to classified documents, with strict enforcement of security clearances. Which access control model is most appropriate?
- 1
- Identify requirements: Strict, non-changeable access enforcement based on fixed security levels.
- 2
- Evaluate options: DAC is too flexible, RBAC does not provide sufficiently strict mandatory enforcement.
- 3
- Conclusion: MAC is the correct choice, as it enforces access based on system-assigned security labels, and users cannot change permissions to grant unauthorized access.
Exam tip:
Always link your choice of model to the specific requirements given in the scenario to get full marks.
4. Other Access Control Approachesβ β β βββ± 3 min
Rule-Based Access Control: Access is granted/denied based on system-wide rules defined by administrators. Example: Deny access to internal networks outside 9am-5pm weekdays.
Attribute-Based Access Control (ABAC): Access is granted based on a combination of user attributes, object attributes, and environmental attributes. Example: Grant access only if the user is a full-time employee connecting from a company IP address. Allows very fine-grained control.
A retail company wants to block all employees from accessing the internal finance system outside of store opening hours. Which access control approach is most suitable?
- 1
- The requirement is a system-wide rule that applies to all employees based on access time.
- 2
- Rule-Based Access Control is designed for this scenario: a single rule can be created to deny access outside opening hours, applying to all users automatically.
- 3
- This is far more efficient than updating individual roles or permissions, so Rule-Based Access Control is the correct choice.
5. Common Pitfalls
Wrong move:
Mixing up authentication and authorization, claiming authorization verifies identity
Why:
Examiners regularly test this distinction, and mixing up the terms will lose all marks for the question
Correct move:
Remember: Authentication = who you are, Authorization = what you can do
Wrong move:
Swapping rows and columns in an access control matrix, putting objects as rows
Why:
The standard definition is strictly rows for subjects, columns for objects, so swapping loses marks
Correct move:
Recall: R = Rows = Subjects (Requesters), C = Columns = Objects (Resources)
Wrong move:
Confusing Role-Based Access Control with Rule-Based Access Control
Why:
The similar names lead to common mix-ups in exam answers
Correct move:
RBAC = Role (job function), Rule-Based = Rules (system-wide access conditions)
Wrong move:
Claiming MAC is the best model for most commercial businesses
Why:
MAC is only suitable for high-security use cases, it is too inflexible for most businesses
Correct move:
RBAC is the most appropriate model for the majority of large commercial organizations
6. Quick Reference Cheatsheet
Concept | Key Definition |
|---|---|
Authentication | Verifies who you are |
Authorization | Verifies what you can do |
Access Control Matrix | Rows = subjects, Columns = objects, cells = permissions |
DAC | Resource owners control access, flexible |
MAC | System enforces access, high security, inflexible |
RBAC | Permissions tied to job roles, most common for enterprises |
Rule-Based Access Control | Access granted per system-wide rules |
ABAC | Access based on user/object/environment attributes |
7. Frequently Asked
What is the key difference between authentication and authorization?
Authentication answers who you are (verifying identity), while authorization answers what you are allowed to do (granting permissions). Authorization always follows successful authentication.
Which access control model is most common for businesses?
Role-Based Access Control (RBAC) is the standard for most modern enterprises, as it scales well and aligns permissions with job functions, simplifying access management.
When this came up on past exams
AI-estimated based on syllabus patterns β cross-check with official past papers for accuracy. Use only as revision-focus signals.
- 2022 Β· Paper 1
Compare RBAC and DAC models
- 2023 Β· Paper 2
Complete access control matrix
- 2024 Β· Paper 1
Authentication vs authorization
Going deeper
What's Next
Access control is a core foundation of all system security, and scenario-based questions on access control models appear regularly in both Paper 1 and Paper 2 of CIE 9618. Understanding how access control works helps you evaluate the security of different system designs and justify recommendations for specific use cases, which is a key skill for exam success. Next, you can explore authentication methods in more detail, learn about common threats to computer systems, or study how access control fits into broader network security architectures.