Network Perimeter Protection · Topic 1 of 6
Access Control and Identity and Access Management
Learn access control principles and models (DAC, MAC, RBAC, ABAC), access for mobile and distributed users, and IAM parts such as SSO, MFA and federation.
- 5 min
- DAC is owner based, MAC is label based, RBAC is role based and ABAC is attribute based.
- Least privilege and separation of duties are the two key principles.
- In a mobile world, identity and device health are the new perimeter.
What it is
Access control decides who or what may use which resource, and in what way. Identity and access management (IAM) is the set of processes and tools that create identities, prove them, grant rights and review them over time.
The exam asks you to tell the access control models apart, to apply the principles to mobile and remote users, and to name IAM components and protocols.
How it works
Principles and terminology
| Term | Meaning |
|---|---|
| Subject | The user, process or device asking for access |
| Object | The resource being accessed, such as a file or share |
| Authentication | Proving an identity |
| Authorization | Deciding what the proven identity may do |
| Accounting | Recording actions, also called auditing |
| Least privilege | Only the rights needed for the task |
| Separation of duties | Splitting a sensitive task between people |
| Need to know | Access only when the job requires the information |
| Implicit deny | Anything not explicitly allowed is refused |
| Access control list (ACL) | A list of who may do what on an object |
AAA stands for authentication, authorization and accounting. Control types by purpose are preventive, detective, corrective, deterrent, recovery and compensating. By form they are administrative, technical and physical.
Access control models
| Model | Who decides | Notes |
|---|---|---|
| Discretionary (DAC) | The owner of the object | Flexible, used in common file systems. Risk: users share too freely. |
| Mandatory (MAC) | The system, using labels and clearances | Strictest. Used in military and high security systems. |
| Role based (RBAC) | Permissions attach to roles, users get roles | Easy to manage at scale. Common in enterprises. |
| Attribute based (ABAC) | Rules over attributes of user, resource and context | Fine grained and dynamic, such as "department is finance and time is business hours". |
| Rule based | Fixed rules apply to everyone | Firewall rules and ACLs are rule based. |
Access control in a distributed and mobile world
The old model trusted anyone inside the office network. Staff now work from home, use their own phones, and reach cloud services directly, so the network edge is no longer the only checkpoint.
- Identity becomes the new perimeter: decide access by who the user is, the health of the device and the context.
- Zero trust thinking: never trust, always verify, for every request.
- Conditional access: require stronger proof when the location, device or risk changes.
- Device management: mobile device management (MDM) enforces encryption, screen lock and remote wipe, and checks device compliance before access.
- BYOD controls: containerize corporate data and limit what personal devices can reach.
- Secure remote access: VPN or zero trust access with multifactor authentication.
- Single sign on (SSO): one login for many apps, reducing password sprawl.
Identity and access management
| IAM element | Purpose |
|---|---|
| Identity lifecycle | Provision at hire, change on role move, deprovision at exit |
| Directory | Central store of identities, such as Active Directory over LDAP |
| Authentication factors | Something you know, have, are, and sometimes where you are |
| Multifactor authentication (MFA) | Uses two or more different factors |
| SSO | One authentication gives access to several systems |
| Federation | Trust between organizations so identities cross boundaries |
| Privileged access management (PAM) | Extra control of administrator accounts, with vaulting and session recording |
| Access review | Periodic recertification of who has what |
Protocols to know:
| Protocol | Use | Port |
|---|---|---|
| Kerberos | Ticket based authentication in Active Directory | 88 |
| LDAP / LDAPS | Directory queries; LDAPS is LDAP over TLS | 389 / 636 |
| RADIUS | Network access AAA, such as Wi-Fi and VPN | UDP 1812 and 1813 |
| TACACS+ | Device administration AAA, encrypts the full payload | TCP 49 |
| SAML | XML based federation and web SSO | Over HTTPS |
| OAuth 2.0 | Delegated authorization to apps | Over HTTPS |
| OpenID Connect | Authentication layer on top of OAuth 2.0 | Over HTTPS |
Two of these are often confused. RADIUS encrypts only the password in the access request, while TACACS+ encrypts the whole body and separates authentication from authorization, which suits router and switch administration.
A worked example
A hospital lets nurses sign in from tablets and home laptops. The IT team puts users in roles such as nurse and billing clerk (RBAC), requires MFA, and enrolls tablets in MDM.
A nurse who tries to sign in from an unmanaged device is allowed to see only a limited view, which is conditional access. When a nurse leaves, the identity lifecycle process removes all access the same day.
How the exam asks about this
- "Which access control model lets the data owner decide who gets access?" → Discretionary access control.
- "Which protocol provides web single sign on by exchanging XML assertions?" → SAML.
- "Which AAA protocol encrypts the entire payload and suits device administration?" → TACACS+.
What to remember for the exam
- DAC is owner based, MAC is label based, RBAC is role based and ABAC is attribute based.
- Least privilege and separation of duties are the two key principles.
- In a mobile world, identity and device health are the new perimeter.
- RADIUS is for network access, TACACS+ is for device administration.
- OAuth 2.0 authorizes, while OpenID Connect and SAML handle authentication and federation.
Authentication is not authorization. A user can be fully authenticated and still be refused a resource because no permission was granted.
Common mistakes
Calling MFA two passwords. Two secrets of the same kind are one factor. MFA needs different factor types.
Confusing RBAC and ABAC. RBAC asks what role you hold, and ABAC evaluates several attributes and context.
Forgetting deprovisioning. Old accounts of departed staff are a common weakness, so the lifecycle must end in removal.
Check yourself
Which access control model uses security labels and clearances?
Mandatory access control.
What is the main benefit of single sign on?
Users sign in once for many applications, which reduces password reuse and helpdesk load.
Why is identity called the new perimeter?
Users and data are now outside the office network, so access decisions rest on identity, device and context.
Topic 1 of 6 in Network Perimeter Protection
Test yourself on Network Perimeter Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.