79. COMPUTER SECURITY IN ACCESS CONTROL SYSTEM

In computer security, access control includes authentication, authorization and audit. It also includes measures such as physical devices, including biometric scans and metal locks, hidden paths, digital signatures, encryption, social barriers, and monitoring by humans and automated systems. In such case the intruder would gain access only to the communication cable going from the reader the input/output module and would not be able to unlock the door by shorting or cutting the wires.


Possibilities of manipulating the input/output module via the communication cable are very low as in most cases proprietary protocols are used, the data is encrypted and modules are configured to communicate only with their host readers.In any access control model, the entities that can perform actions in the system are called subjects, and the entities representing resources to which access may need to be controlled are called objects (see also Access Control Matrix). Subjects and objects should both be considered as software entities, rather than as human users: any human user can only have an effect on the system via the software entities that they control.


Although some systems equate subjects with user IDs, so that all processes started by a user by default have the same authority, this level of control is not fine-grained enough to satisfy the Principle of least privilege, and arguably is responsible for the prevalence of malware in such systems (see computer insecurity).In some models, for example the object-capability model, any software entity can potentially act as both a subject and object.


Access control models used by current systems tend to fall into one of two classes: those based on capabilities and those based on access control lists (ACLs). In a capability-based model, holding an unforgeable reference or capability to an object provides access to the object (roughly analogous to how possession of your house key grants you access to your house); access is conveyed to another party by transmitting such a capability over a secure channel.