Access control is the security process that determines a subject's identity and limits the scope of resources that subject is permitted to act on within a system.
Every access control mechanism revolves around three elements: the subject making the request, the resource being requested, and the specific action, such as viewing, downloading, editing, or approving. An access control policy is the set of rules that combines these three elements and produces an allow or deny outcome.
Access control exists in two forms. Physical access control governs entry to physical spaces using card readers, electronic locks, or biometrics. Logical access control governs permissions on operating systems, business applications, databases, and APIs, and this is the scope of this article. The two layers reinforce each other directly, since a server with tightly managed permissions can still have its hard drive removed if the server room itself has no entry control.
Firewall blocks malicious traffic from entering the internal network, encryption protects data if it is stolen in transit, while access control limits the damage once an attacker is already inside with a valid identity. The scale of this scenario has been measured: Verizon's 2026 Data Breach Investigations Report, which analyzed more than 22,000 confirmed data breaches across 145 countries, found that credential abuse appeared in 39% of breaches, the highest rate among all tracked attack patterns. This is why access control is considered a foundational measure, alongside patching security vulnerabilities and database security.
Access control operates on the IAAA model, made up of four sequential steps: Identification, Authentication, Authorization, and Accountability.
IAAA is the foundational framework presented in the CISSP Common Body of Knowledge reference from (ISC)². Every access request passes through all four steps before the system returns data. The first three steps decide whether to allow or deny; the last ensures every action can be traced back to a specific subject.
Identification is the subject declaring who it is through a unique identifier, such as a username, employee ID, or service ID. This step proves nothing on its own, but if multiple users share one identity, all three subsequent steps lose their value, since the system can no longer tell who did what. This is why shared accounts are considered a serious flaw even when the password itself is well protected.
Authentication requires the subject to prove that the identity just declared belongs to them, using a password, an OTP code, biometrics, or a digital certificate. Authentication only confirms who you are. A system that lacks the authorization step behind it opens all its data to anyone who logs in successfully, including an account compromised through a brute force attack.
Authorization is where scope is decided. The system takes the identity just authenticated, checks it against the access policy, and returns a decision for each action on each resource. The same employee might view their department’s revenue report but be denied when opening the company-wide payroll sheet.
| Criteria | Authentication | Authorization |
|---|---|---|
| When it happens | Once, when a session opens | Repeated on every request |
| Where it is enforced | Identity management system | Policy enforcement point on the server side |
| Consequence of a failure | An attacker successfully logs in | A legitimate user reaches data outside their scope |
| Real world example | An employee logs into accounting software | An employee can view an invoice but cannot approve the spend |
Organizations that invest heavily in multi factor authentication but leave authorization loose still face data leak risk on par with organizations that have no controls at all.
Before responsibility can be recorded, the authorization decision must be enforced in the right place, in the form of a token or session with a limited lifetime, with the enforcement point on the server side. Hiding a button in the interface is not access control, since the request can still be sent directly to the server or intercepted through a man in the middle attack.
Accountability records who accessed which resource and did what. Access logs are the only evidence available to determine the scope of impact when a data breach occurs. The cost of detecting a breach late is not trivial: IBM and the Ponemon Institute’s Cost of a Data Breach 2026 report, covering 602 organizations across 16 countries, found the global average cost of a data breach was $4.99 million, up 12% from the prior period and the highest figure on record.
Access control comes in several models, distinguished by two criteria: who holds the authority to grant access, and what basis that decision rests on. Below are the models most common in practice.
Discretionary access control gives the decision authority to the resource owner. The creator of a file chooses who to share it with and what permissions to grant, the way internal shared folders typically work. Its advantage is flexibility; its drawback is that permissions spread beyond control until the organization can no longer answer who currently holds access to sensitive data.
Mandatory access control places the decision authority with administrators through classification labels. Each resource is assigned a sensitivity level, each subject is assigned a trust level, and the system only grants access when the two levels are compatible. Mandatory access control provides the highest level of control, at the cost of high operating overhead, so it is typically used in defense and critical infrastructure.
Role-based access control assigns permissions by job role rather than by individual. An organization defines roles such as accountant or system administrator, attaches a fixed set of permissions to each role, and assigns staff to those roles. When an employee changes department, the organization only needs to change their role instead of reviewing dozens of individual permissions. This is the most common model because it strikes a good balance between control and operating cost.
Attribute-based access control makes decisions based on a combination of attributes rather than a fixed role, combining user attributes, the resource’s confidentiality level, and context such as time, location, or device type. This lets attribute-based access control express rules that role-based access control cannot, such as allowing customer records to be viewed only during business hours and only from a company-managed device.
Rule-based access control lets administrators define rules based on generally applicable conditions, typically around access time windows, IP address ranges, or a device’s security posture. Rule-based access control rarely stands alone; it usually runs alongside role-based access control as an additional filter layered on top of role-assigned permissions.
Break-glass access control is an emergency account mechanism that allows normal permission limits to be bypassed during a severe system incident. Because it is by nature a permission override, break-glass access control must come with three conditions: logging every activation, alerting the security team immediately, and a post-use review after every activation.
| Model | Decision mechanism | Who controls it | Complexity | Best suited for |
|---|---|---|---|---|
| Discretionary access control | Owner grants access | The resource's creator | Low | Sharing internal, low-sensitivity documents |
| Mandatory access control | Matching classification labels | System administrators | High | Classified data, critical infrastructure |
| Role-based access control | Permissions assigned by role | IT and HR | Medium | Most enterprises of any size |
| Attribute-based access control | Combination of attributes and context | Policy design team | High | Multi-branch systems with many exceptions |
| Rule-based access control | Rules based on general conditions | System administrators | Low to medium | Supplementary layer for role-based access control |
| Break-glass access control | Controlled permission override | Security team | Medium | Emergency incident situations |
An effective access control system depends not only on the model chosen but also on the principles that govern how that model is configured. The same role-based access control setup can be implemented tightly or loosely.
The principle of least privilege states that each account should receive only the permissions needed for its job, and only for as long as needed. Administrative rights should be granted per session and expire automatically, which directly reduces the maximum damage possible if an account is compromised.
The principle of separation of duties prevents a single account from controlling an entire sensitive process end to end. The person who initiates a transaction should not also approve it; the person who configures the logging system should not also have permission to delete logs.
Zero trust elevates these two principles into a complete architecture. The traditional perimeter approach trusts anything that has passed the outermost line of defense, so once an attacker reaches the internal network, lateral movement faces almost no obstacles. Zero trust reverses that default: it does not trust based on network location, it re-verifies identity and device posture at every session, and it segments the system into independent zones. This need is growing sharply as access now extends beyond the organization itself, since Verizon’s 2026 Data Breach Investigations Report found that breaches involving a third party reached 48%, up from 30% in the prior reporting period. Zero trust is commonly deployed alongside an NGFW and a Defense in Depth layered security approach.
Four principles must be applied together when designing access control:
The application and API layer is where most data leak incidents have originated in recent years, because access control here is often overlooked while the infrastructure layer receives heavy investment. In the OWASP Top 10, 2025 edition, Broken Access Control holds the A01 position, the most severe web application security risk category, with 100% of tested applications showing at least one flaw in this category and more than 1.8 million occurrences recorded, the highest of all ten risk categories. This is the direct result of an application correctly authenticating a user but skipping the step of checking permissions on each specific resource, allowing a valid account to reach data that is not within its scope.
APIs carry the greatest risk within this category, since they are built for machine-to-machine calls, making authorization checks easy to miss on secondary endpoints, internal endpoints exposed externally, or old versions left in place after an upgrade. A second risk comes from valid accounts themselves: a botnet using real login credentials passes both authentication and authorization cleanly, then calls the API repeatedly at high speed to harvest all the data that account is permitted to view. Looked at individually, every single request complies with policy; only the aggregate behavior is abnormal, which is why rate limiting should be treated as part of access control, not merely an overload prevention measure.
Application-layer controls that should be implemented:
Reviewing every authorization path in the source code takes time, but a protective layer in front of the website can be activated right away. VNETWORK's WAF Free package protects a website against vulnerabilities aligned with the OWASP Top 10, without requiring a dedicated security team or any change to existing IT architecture.
Button;Try it now;https://partner.vnetwork.vn/?utm_source=google&utm_medium=blog&utm_campaign=waf_free&utm_term=accesscontrollagi;_blank
Access control is not only a technical requirement but also a legal obligation. Vietnam’s legal framework for information security and data has shifted from recommendation to mandatory requirement, with penalties for organizations that fail to comply.
The readiness of domestic enterprises still falls well short of that requirement. The National Cyber Security Association's (NCA) Vietnam Cybersecurity Summary Report 2025 found that 9.38% of surveyed agencies and enterprises had no form of internet access control at all, while 52.30% had suffered harm from a cyberattack during the year, up from 46.15% in 2024.
Decree 53 provides implementation guidance for the Cybersecurity Law, setting requirements for storing data domestically and protecting information systems important to national security. Along with this comes the obligation to control who can access user data and to provide access logs when requested by authorities.
The Personal Data Protection Law requires organizations to process personal data only within the purpose already disclosed to the data subject. Access control is the technical mechanism that directly enforces this obligation, since limiting the scope of processing is, in essence, limiting who within the organization may touch which type of data.
The 2024 Data Law and its guiding documents require classifying data by importance and setting corresponding access conditions, closely tied to designing a permission matrix based on sensitivity level rather than granting uniform access across an entire data store.
ISO 27001 devotes an entire control group to access control, covering authorization policy, identity management, privileged account management, and periodic review. For enterprises unsure where to start, this is a ready-to-use self-assessment framework.
| Regulation / Standard | Access-related requirement | Corresponding access control measure |
|---|---|---|
| Decree 53/2022/ND-CP | Protect important information systems, trace user data access | Centralized logging, role-based access, log retention for the required period |
| Personal Data Protection Law | Process personal data only for the disclosed purpose | Least privilege, permission granted down to the sensitive data field |
| Data Law 2024 | Classify data and set access conditions by sensitivity level | Data labeling, permission matrix by sensitivity level |
| ISO 27001 | Access control policy and periodic permission review | Centralized identity management, privileged account management |
Implementing access control needs to follow the right sequence, since the most common mistake is jumping straight to buying a tool before the organization even knows what data it has and who currently holds which permissions.
Build a complete catalog of every system, application, database, and file store currently in operation, along with the sensitivity level of the data involved. An organization cannot protect what it does not know it has, so this is the basis for determining which resources need to be tightened first.
List the actual job roles in the organization, and define the minimum permission set for each role on each inventoried resource. The permission matrix becomes the single source of truth that every system must follow.
Put the permission matrix into practice through a centralized identity management system, single sign-on, multi factor authentication for high-privilege accounts, and a privileged account management solution. Tools only work once the matrix from step two is already clear.
The IAAA model describes a single access request, but access rights exist over time. Granting, adjusting, and revoking permissions therefore needs to be tied to HR milestones, including onboarding, transfer, and departure, along with periodic review to reclaim excess permissions.
Even a correct roadmap can fail because of mistakes in day-to-day operations. What they share in common is that they build up quietly and only surface once an incident has already happened.
Access control decides, in source code, who can read, edit, or delete which data, and this is the responsibility of an organization’s identity management system and development team; no security platform can replace it. But before a request ever reaches that authorization layer, it can still carry exploit code, endpoint scanning behavior, or bot traffic posing as a legitimate user. VNIS, VNETWORK’s security and acceleration platform for Web, App, and API, handles exactly this part of the job. Among VNIS’s features, the following four map most directly onto the access control risks discussed above:
Beyond these features, VNIS also has a SOC team monitoring 24/7 and currently protects hundreds of thousands of websites, applications, and APIs worldwide, suited for enterprises seeking long-term security for their systems. WAF Free, part of the VNIS ecosystem, is the free initial step that lets enterprises experience application-layer protection before considering an upgrade to more comprehensive security packages.
Button;Try it now;https://partner.vnetwork.vn/?utm_source=google&utm_medium=blog&utm_campaign=waf_free&utm_term=accesscontrollagi;_blank
Access control determines the actual extent of damage when an account is compromised. From understanding the concept correctly, grasping the four steps of the IAAA model, choosing the right authorization model, to closing blind spots at the application and API layer, each step narrows the scope an attacker can reach. Combined with a legal framework that is tightening in Vietnam, access control is now a mandatory requirement, not an option. Contact VNETWORK for advice on a solution for your organization’s web, app, and API systems.
Access control is the security process that determines the identity of a user or system, then limits the scope of resources that subject is permitted to act on. The term applies both to hardware-based entry control systems and to access permission control in information security.
In the IAAA model, authentication is the second step and authorization is the third. Authentication establishes identity, answering the question of who you are through a password, an OTP code, or biometrics. Authorization determines the scope of permissions after identity has been authenticated. A system without authorization opens all its data to any account that logs in successfully.
An access control list is a list attached directly to each resource, specifying which subjects can perform which actions on that resource. An ACL is a mechanism for storing the outcome of authorization decisions, not a decision-making model, and becomes difficult to review once the number of resources reaches into the thousands.
Broken access control allows a validly logged-in user to access another user’s data simply by changing an identifier parameter. Broken access control is dangerous because it requires no specialized attack tooling and generates no abnormal traffic, so it often goes undetected early.
Yes. The Cybersecurity Law together with Decree 53/2022/ND-CP, the Personal Data Protection Law, and the Data Law all impose obligations to limit the scope of data access and retain access logs. Access control is the technical mechanism that directly enforces these obligations.