Video summary

Explain Access Control Types| Administrative, Logical, Physical| Preventive, Detective, Compensating

Main summary

Key takeaways

Educational

Main ideas / lessons conveyed

  • Access Control definition: Access Control is the process of regulating and managing access to resources (systems/data) or physical spaces.

  • Why it’s required (goals):

    • Protect sensitive information
    • Provide confidentiality
    • Maintain data integrity
    • Ensure availability of resources for authorized users
    • Prevent unauthorized access
    • Create a secure and controlled environment with:
      • Identification & authentication (who the user is)
      • Authorization (what the user is allowed to do, based on roles/permissions)
      • Accountability using logging and monitoring

Types of Access Control

1) Categorized by how they are implemented

A. Administrative Access Control

Definition: Policies, procedures, and measures implemented by administrators.

Examples (outlined by the video):

  • Access control policies
    • Define/enforce rules for granting and managing access
    • Specify who can access what, under which conditions, and for what purpose
  • Password policies
    • Minimum password length
    • Complexity rules
    • Expiration periods
    • Restrictions on password reuse
  • User account management
    • Create/modify/delete accounts
    • Grant/revoke privileges based on roles/responsibilities
  • User provisioning and deprovisioning
    • Grant access when employees join
    • Revoke access when employees leave
  • Assigning permissions via role-based access
    • Define roles and map users to roles based on job functions
  • Security awareness and training
    • Educate employees about access control and security responsibilities
  • Auditing and monitoring mechanisms
    • Track and log access activities to detect/investigate unauthorized or suspicious attempts

B. Technical / Logical Access Control

Definition: Software/hardware/firmware-based technological measures controlling access.

Examples:

  • Authentication mechanisms
    • Password-based
    • Biometric-based
    • MFA / 2FA
  • Access Control Lists (ACLs)
    • Allow/deny permissions for users or groups on resources
  • Encryption
    • Protects data in transit and at rest
    • Only authorized users can decrypt/access data
  • Firewalls
    • Filter incoming/outgoing network traffic using rules to block unauthorized access
  • Intrusion Detection and Prevention Systems (IDPS)
    • Monitor for suspicious behavior/known attack patterns
    • Detect and prevent malicious/unauthorized access attempts
  • VPNs
    • Create secure remote connections over public networks (encrypted transmissions)
  • SIEM (Security Information and Event Management)
    • Collects and analyzes security event logs from multiple sources
    • Helps identify/respond to incidents

C. Physical Access Control

Definition: Mechanisms to regulate physical access to buildings/facilities/areas.

Examples:

  • Physical barriers
    • Fences, gates, turnstiles
    • Turnstiles: allow one person through at a time
    • Mantraps: two-door enclosed area where one must close before the other opens
  • Locks and keys
    • Padlocks, deadbolts, electronic locks
  • Access cards and badges
    • Card readers/electronic systems granting access to specific zones/areas
  • Biometric systems
    • Fingerprint, retina/iris scan, facial recognition
  • Surveillance systems
    • Cameras to monitor/record facility activities
  • Security guards
    • Stationed at entry points or areas to control access and respond to incidents
  • Visitor management systems
    • Register visitors, issue badges, monitor visitor activity
  • Alarm systems
    • Motion detectors/intrusion sensors triggering alerts
  • Physical access logs
    • Maintain records of physical access for audit trails and incident investigation

2) Categorized by what they do

The video presents multiple control “types” based on their function:

A. Preventive Access Control

Purpose: Proactively prevent unauthorized access/breaches.

Examples (as listed in the video):

  • Perimeter security / physical barriers: fences, walls, gates
  • Security signs for restricted areas
  • Video surveillance and alarms as deterrent/prevention
  • Electronic access control systems: card readers, keypads, biometrics
  • Proper lighting (including motion-activated lighting)
  • Cameras
  • Firewalls
  • IDPS
  • Antivirus / security software
  • Security awareness training (reduces social engineering and negligent credential sharing)
  • Security policies/procedures
    • Strong password policies
    • Access revocation processes
    • Incident response procedures
  • Additional preventative examples mentioned:
    • Data classification
    • Penetration testing
    • Job rotation
    • Separation of duties

B. Detective Access Control

Purpose: Detect and identify unauthorized access or breaches after they occur.

Examples:

  • Security logging and auditing
    • Record access events, system activity, user actions
    • Review logs regularly to find suspicious activity
  • SIEM (collect/correlate logs from multiple sources)
  • Intrusion detection systems
  • Cameras / video surveillance
  • Monitoring tools
    • System and network monitoring
  • UBA (User Behavior Analytics)
    • Analyze normal behavior baselines and flag anomalies
    • Example anomalies: unusual login times, access to unauthorized resources, excessive downloads
  • Incident response planning (to quickly detect/respond)
  • Forensics analysis
    • Examine digital evidence (logs, snapshots, network captures) to reconstruct events and breach extent
  • Security audits and penetration tests
    • Identify vulnerabilities/weaknesses before exploitation
  • Honey pots / honey nets to detect compromise
  • Mandatory vacation policies
  • Reviews of user access

Note from the video: controls can overlap categories (e.g., job rotation can be both preventative and detective).

C. Corrective Access Control

Purpose: Act after a breach is detected to mitigate impact, restore security, and prevent recurrence.

Examples:

  • Incident response and management
    • Incident plan: identify, contain, investigate, remediate
  • Access revocation
    • Disable/revoke privileges for compromised accounts
  • System patches and updates
    • Fix vulnerabilities exploited during the incident
  • Password reset / related remediation
  • System restoration and backups
    • Restore systems to clean/non-compromised state (backups/snapshots)
  • Security awareness and training
    • Use lessons learned from the incident
  • Continuous monitoring and intrusion detections
  • Anti-malware / anti-virus
    • Quarantine/remove malware

D. Deterrent Access Control

Purpose: Discourage attempts by increasing perceived risk or effort.

Examples:

  • Surveillance cameras, security guards, access control systems (visible monitoring signals)
  • Warning signs/labels indicating restricted/protected areas
  • Fences/barriers
  • Controlled entry points showing only authorized entry
  • Adequate lighting
  • Security patrols
  • Alarm systems (audible alarms on unauthorized events)
  • Secure storage (locked cabinets/safes/secure rooms)
  • Awareness programs to promote a culture of vigilance

E. Recovery Access Control

Purpose: Restore normal operations and minimize downtime/damage after an incident.

Examples:

  • Incident response plan execution
    • Coordinate responsibilities and actions during/after the incident
    • Document impact, root cause, and recovery actions for improvement
  • System restoration
    • Restore applications/data to known secure state using backups
  • Change management procedures
    • Review/validate recovery changes before implementation
  • Patch management
  • User account remediation
    • Review/update accounts and revoke compromised access
  • System hardening
    • Tighten configurations and access controls
  • Security awareness training
  • Lessons learned and continuous improvement
    • Post-incident reviews to find gaps and improvements

Additional examples mentioned:

  • Server imaging
  • Clustering
  • Antivirus/anti-malware
  • Fault-tolerant / redundancy approaches (e.g., shadowing, virtual machine shadowing, database shadowing)

F. Directive Access Control

Purpose: Direct or influence subject behavior to enforce compliance with policies.

Examples:

  • Escape route / exit signs
  • Notifications
  • Security policy requirements communicated to users

G. Compensating Access Control

Purpose: Provide supplementary controls when primary controls are insufficient/unfeasible.

Examples:

  • MFA to supplement weak password reliance
  • VPNs to secure remote access over public networks
  • Data encryption (at rest and in transit) to keep data unreadable even if accessed
  • SIEM to improve log monitoring and incident detection/response
  • Network segmentation to limit breach impact
  • Third-party security audits/assessments
  • Redundancy and failover
    • Backup components take over if systems fail

Overall takeaway (consolidated)

  • The core objective: only authorized users get appropriate access, while preventing unauthorized access.
  • Access Control is structured both by:
    • Implementation method: administrative vs technical/logical vs physical
    • Function/effect: preventive, detective, corrective, deterrent, recovery, directive, compensating

Speakers / sources featured

  • Speaker(s): “Cyber Platter” (presented as the video host/channel; no individual person named in the subtitles).
  • Sources: No external sources or documents are explicitly cited by name.

Original video