Access Controls Concepts
Physical and logical access controls, the principle of least privilege, and access-control models.
Access controls govern who or what can access resources, built on identification, authentication, authorization, and accountability. Physical controls protect facilities: badges, locks, mantraps, fences, guards, and CCTV. Logical (technical) controls protect systems: passwords, MFA, permissions, and encryption.
The guiding principles are least privilege (grant only what is needed), need to know, and separation of duties (no single person controls an entire sensitive process), which together reduce the risk of abuse and error.
The principle of least privilege means users should have what?
A mantrap and a security guard are examples of what kind of control?