The scenario describes the implementation of role-based permissions, a core mechanism of access control. This directly addresses the concept of authorization. Authorization is the process that determines what permissions an authenticated entity (a user or system) has for accessing resources or performing actions. By assigning permissions based on job roles, the company is explicitly defining and enforcing what each user is allowed to do, which is the essence of authorization. This practice enforces the principle of least privilege to mitigate risks like insider attacks.

A. Authentication: This is the process of verifying a user's identity (e.g., with a password or biometric scan), not determining their access rights.

B. Accounting: This refers to the tracking and logging of user activities for auditing purposes, which occurs after access has been granted and used.

C. Availability: This is a goal of security (part of the CIA triad) that ensures systems and data are accessible to authorized users, not the process of granting permissions.

---

1. National Institute of Standards and Technology (NIST). (2006). Assessment of Access Control Systems. NISTIR 7316.

Page 10

Section 2.2.2: Defines Authorization as "The process of determining

by evaluating applicable access control information

whether a subject is allowed to have the specified types of access to a particular resource... The authorization process occurs after the authentication process." This directly supports that assigning permissions is an act of authorization.

2. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations. NIST Special Publication 800-53

Revision 5.

Page 101

Section AC-2 (Account Management): This control family discusses assigning access rights (privileges) based on roles and the principle of least privilege

which are fundamental to authorization. The document states

"The organization: a. Defines and documents the rights and privileges of each assigned account role."

3. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278–1308.

Section I.A.3

Page 1281: This foundational academic paper distinguishes between authentication and authorization. It explains that after authentication confirms a user's identity

the system must have a way to "authorize access

" which involves consulting a list of authorizations (permissions) for that user. This establishes the academic basis for the distinction. (DOI: https://doi.org/10.1109/PROC.1975.9939)

4. Massachusetts Institute of Technology (MIT) OpenCourseWare. (2019). 6.858 Computer Systems Security

Fall 2014.

Lecture 2: Control Hijacking

Slide 5: The lecture slides clearly define the security model components: "Authentication: who is the user? Authorization: is user X allowed to do operation Y? (access control)." This university source explicitly equates authorization with access control and the act of determining allowed operations.