Security Structure  «Prev  Next»

Lesson 5

Regulating Network Access to Improve Security

Network access control is the practice of making sure that only the right identities get into the right systems, at the right time, in the right way - and that everything else is denied. Strong access control directly protects confidentiality (who can see data), integrity (who can change it), and availability (who can affect systems or services).

Modern access control is not just "who can log in." It is an ongoing security posture that includes:

The rest of this lesson walks through these areas and explains how they work together.

1. Identity and Access Management (IAM)

Identity and Access Management answers two questions:

  1. Who are you? (authentication)
  2. What are you allowed to do? (authorization)

Good IAM reduces the blast radius of a compromised account and makes it easier to prove compliance. Key IAM practices include:

Under the hood, IAM depends on modern cryptography. Legacy encryption like DES is considered obsolete; secrets, passwords, and stored credentials should be protected with strong algorithms such as AES for encryption and SHA-256 or stronger for hashing.

2. Network Segmentation and Isolation

Network segmentation means you do not treat your internal network as one giant “trusted” zone. Instead, you break it into smaller zones and strictly control which systems can talk to which.

Why segmentation matters:

Typical segmentation techniques include:

Segmentation limits the damage an attacker can do after the first foothold. It also makes alerting cleaner: if a workstation in “Accounting-Laptops” suddenly talks to “Prod-DB-Network,” you know something is wrong.

3. Continuous Monitoring and Incident Response

Controlling access is not enough - you must verify that your controls are actually working and react when they fail.

The faster you detect and contain unauthorized access, the less time an attacker has to laterally move, elevate privileges, or tamper with logs.

4. Enforcement at the System Level

Even with IAM and segmentation in place, the operating system and applications still need to enforce rules locally. This is where concepts like Access Control Lists (ACLs) and execution control come in.

Access Control Lists (ACLs)

An Access Control List defines who (which user, service account, group, or process) is allowed to interact with a resource and how they are allowed to interact with it.

An ACL entry typically looks like: “Group X may read this file but may not write or delete it,” or “Service account Y may open TCP port 8443 to host Z.”

If a user or process attempts any action that is not explicitly allowed, the OS or service denies it and logs that decision. This protects databases, application config files, secrets vaults, and other high-value assets.

Example: A firewall or router ACL that only allows an application server to reach a backend service: 

# Only allow the app server 10.20.5.17 to reach the DB on TCP/5432
permit tcp host 10.20.5.17 host 10.20.9.42 eq 5432

# Block everything else by default
deny ip any host 10.20.9.42

In plain English: the database should not be reachable by “whoever can guess the IP.” It should be reachable only by the specific application node(s) that are supposed to talk to it.

Application Execution Control / Allowlisting

Another layer of access control is restricting what programs are even allowed to run - especially on servers that handle sensitive data or on user endpoints where malware is a risk.

Historically this was described as an Execution Control List (ECL): a policy that determines which actions a program may take once it’s running. Modern operating systems and endpoint protection tools generalize this concept into “application allowlisting” or “application control.”

Key ideas:

This turns “malware ran and we hope antivirus catches it” into “malware cannot perform high-risk actions even if it runs.”

5. Configuration Discipline

Even the best access control model can be destroyed by leaving defaults in place. A misconfigured service that ships with “admin / admin” credentials or exposes an unrestricted management port to the internal network can completely bypass IAM, ACLs, and segmentation.

To close that gap:

Summary

Controlling network access is not a single product. It is a set of reinforcing practices:

When those pieces work together, unauthorized users are blocked, compromised accounts are contained, and suspicious activity is noticed quickly instead of weeks later. That is the goal of access control.


SEMrush Software 5 SEMrush Banner 5