ITU-T X.805 - Security Architecture for End-to-End Communications Dim1-Access-Control-RBAC-Authorization-Resources-Network-Elements-Services-Applications: ITU-T X.805 Security Dimension 1 - Access Control + Role-Based Access Control (RBAC) + Authorization + Resources + Network Elements + Services + Applications + Access Limitations + Authorized Personnel + Discretionary + Mandatory Access Control

Security Dimension 1 Access Control per X.805 Clause 6.1: Access Control protects against unauthorized use of network resources. Access Control ensures that only authorized personnel or devices are allowed access to network elements + stored information + information flows + services + and applications. In addition Role-Based Access Control (RBAC) provides different access levels to guarantee that individuals and devices can only gain access to and perform operations on network elements + stored information + and information flows for which they are authorised. (1) Access Control Sub-Categories per X.805 and related frameworks: (a) Discretionary Access Control (DAC) - resource owner discretion + Access Control Lists (ACLs); (b) Mandatory Access Control (MAC) - system-enforced labels + classification levels + Bell-LaPadula + Biba; (c) Role-Based Access Control (RBAC) - per ISO/IEC 10181-3 + NIST RBAC + ANSI INCITS 359; (d) Attribute-Based Access Control (ABAC) - per NIST SP 800-162 + XACML; (e) Risk-Adaptive Access Control (RAdAC); (f) Capability-Based Access Control. (2) Implementation Mechanisms: (a) ACL Access Control Lists (network + filesystem); (b) Identity and Access Management (IAM) systems; (c) Privileged Access Management (PAM) for administrative accounts; (d) Single Sign-On (SSO) + SAML + OAuth 2.0 + OpenID Connect; (e) Multi-Factor Authentication (MFA) gating access; (f) Just-In-Time (JIT) access provisioning; (g) Just-Enough-Administration (JEA); (h) Zero Trust per NIST SP 800-207 - never trust always verify; (i) network access controls (802.1X + 802.1AE MACsec + NAC Network Access Control + ISE Identity Services Engine); (j) routing controls (BGP RPKI + route filtering); (k) firewall rules (stateful + stateless); (l) WAF Web Application Firewall + API Gateway access policies. (3) Access Control per Security Layer: (a) Infrastructure Layer - physical access controls + biometric + smart card + access to lines + routers + switches + datacenter; (b) Services Layer - service-level authorization + IP service authorization + DNS access + AAA Authentication Authorization Accounting + SS7 access + Mobile NSS + IMS HSS subscriber; (c) Applications Layer - application-level authorization + Email + Web + Directory + File Transfer authorization. (4) Access Control per Security Plane: (a) Management Plane - administrator access + OAM + Configuration; (b) Control Plane - inter-device signalling control + routing protocol authentication; (c) End-User Plane - subscriber + user access to services + content. (5) Threats Mitigated per X.805 Table 1: (a) Destruction (Y); (b) Corruption (Y); (c) Removal (Y); (d) Disclosure (Y); (e) Interruption (Y) - all 5 threats. (6) Standards Referenced: (a) ISO/IEC 27001 A.9 (now A.5.15-A.5.18 + A.8.2-A.8.5 in 2022) Access Control; (b) ISO/IEC 27002 + ISO/IEC 27033 Network Security; (c) NIST SP 800-53 Rev 5 AC family; (d) NIST SP 800-162 ABAC; (e) NIST SP 800-207 Zero Trust; (f) NIST SP 800-63 Digital Identity Guidelines; (g) 3GPP TS 33.310 NDS/AF + TS 33.501 5G Security; (h) GSMA NESAS Network Equipment Security Assurance Scheme; (i) PCI DSS Req 7 + 8; (j) HIPAA Security Rule Access Control. (7) Modern Evolution: (a) Zero Trust replaces perimeter Access Control with continuous verification; (b) SASE Secure Access Service Edge integrates ZTNA Zero Trust Network Access with SD-WAN; (c) Identity-First Security for cloud-native; (d) Just-In-Time provisioning replacing standing privileges; (e) CIEM Cloud Infrastructure Entitlement Management; (f) Workload Identity for K8s + service mesh + SPIFFE/SPIRE. Coordinates with X.805 Layer 1/2/3 + Plane 1/2/3 + Threats Destruction/Corruption/Removal/Disclosure/Interruption + Security Dimension 2 Authentication (foundation for Access Control) + Security Dimension 6 Data Integrity (Access Control prevents unauthorized modification) + Security Dimension 8 Privacy (Access Control implements need-to-know). ITU-T X.805 Security Dimension 1 Access Control applies.