Definition
Access controls are security mechanisms that determine who or what can view, use, or perform actions on resources within a system. They function by enforcing policies that grant or deny access based on user identity, roles, or other attributes. Implementing robust access controls is crucial for protecting sensitive data, preventing unauthorized modifications, and maintaining operational integrity. For instance, a company might use role-based access control to ensure only finance department employees can view payroll information. This differs from authentication, which verifies identity, as access control dictates what that verified identity is permitted to do. Access controls are a fundamental concept tested on CompTIA Security+, CySA+, and CISSP certifications.