Front cover - IBM Redbooks

1.3.4 Access control
Access control allows an organization to protect critical resources by limiting
access to only authorized and authenticated users. In other words, access
control is any mechanism by which a system grants or revokes the right to
access some data, or perform some action. Normally, a user must first log in to a
system, using some authentication system. Next, the access control mechanism
controls what operations the user may or may not make by comparing the user
ID to an access control list entry in a database.
Access control systems include a number of permissions and privileges, some of
which are the following:
► File permissions, such as create, read, edit,or delete on a file server
► Program permissions, such as the right to execute a program on an
application server
► Data rights, such as the right to retrieve or update information in a database
► Managerial rights, such as the ability to confer to some users new access
privileges and/or revoke such privileges to some other users
1.3.5 Non-repudiation
Depending on the environment, access may be controlled by the resource
owner, or it may be done automatically by the system through security labels.
The resource owner can specify who can access the information, how it can be
accessed, when it can be accessed, and under what conditions it can be
accessed (for example, when executing specific applications, programs, or
transactions).
The functional goal is to assure that security is maintained for resources, whether
they are in a central system, distributed, or mobile (as is the case with files and
programs).
Non-repudiation can be viewed as an extension to the identification and
authentication services, since non-repudiation relies on authentication to know
who someone is. Obviously, if authentication is weak, then so is the
organization’s ability to know who’s doing what.
The non-repudiation service can protect a recipient against a false denial by an
originator that the data has been sent, and it can protect an originator against the
false denial of a recipient that the data has been received.
Chapter 1. Fundamentals of IT security 21