ITU-T X.805 - Security Architecture for End-to-End Communications
X.805 Security Dimension 1 - Access Control
ITU-T X.805 - Security Architecture for End-to-End Communications X805-Dim1-Access-Control-RBAC-Authorization-Resources-Network-Elements-Services-Applications: ITU-T X.805 Security Dimension 1 - Access Control + Role-Based Access Control (RBAC) + Authorization + Resources + Network Elements + Services + Applications + Access Limitations + Authorized Personnel + Discretionary + Mandatory Access Control
Security Dimension 1 Access Control per X.805 Clause 6.1: Access Control guards network resources against use without authorization, admitting only authorized staff or devices to services, applications, information flows, stored information and network elements. Role-Based Access Control (RBAC) adds graded levels of access, so people and devices can reach and act on only the information flows, stored information and network elements for which they hold authorisation. (1) Access Control Sub-Categories per X.805 and related frameworks: (a) Discretionary Access Control (DAC) - resource owner discretion + Access Control Lists (ACLs); (b) Mandatory Access Control (MAC) - system-enforced labels + classification levels + Bell-LaPadula + Biba; (c) Role-Based Access Control (RBAC) - per ISO/IEC 10181-3 + NIST RBAC + ANSI INCITS 359; (d) Attribute-Based Access Control (ABAC) - per NIST SP 800-162 + XACML; (e) Risk-Adaptive Access Control (RAdAC); (f) Capability-Based Access Control. (2) Implementation Mechanisms: (a) ACL Access Control Lists (network + filesystem); (b) Identity and Access Management (IAM) systems; (c) Privileged Access Management (PAM) for administrative accounts; (d) Single Sign-On (SSO) + SAML + OAuth 2.0 + OpenID Connect; (e) Multi-Factor Authentication (MFA) gating access; (f) Just-In-Time (JIT) access provisioning; (g) Just-Enough-Administration (JEA); (h) Zero Trust per NIST SP 800-207 - never trust always verify; (i) network access controls (802.1X + 802.1AE MACsec + NAC Network Access Control + ISE Identity Services Engine); (j) routing controls (BGP RPKI + route filtering); (k) firewall rules (stateful + stateless); (l) WAF Web Application Firewall + API Gateway access policies. (3) Access Control per Security Layer: (a) Infrastructure Layer - physical access controls + biometric + smart card + access to lines + routers + switches + datacenter; (b) Services Layer - service-level authorization + IP service authorization + DNS access + AAA Authentication Authorization Accounting + SS7 access + Mobile NSS + IMS HSS subscriber; (c) Applications Layer - application-level authorization + Email + Web + Directory + File Transfer authorization. (4) Access Control per Security Plane: (a) Management Plane - administrator access + OAM + Configuration; (b) Control Plane - inter-device signalling control + routing protocol authentication; (c) End-User Plane - subscriber + user access to services + content. (5) Threats Mitigated per X.805 Table 1: (a) Destruction (Y); (b) Corruption (Y); (c) Removal (Y); (d) Disclosure (Y); (e) Interruption (Y) - all 5 threats. (6) Standards Referenced: (a) ISO/IEC 27001 A.9 (now A.5.15-A.5.18 + A.8.2-A.8.5 in 2022) Access Control; (b) ISO/IEC 27002 + ISO/IEC 27033 Network Security; (c) NIST SP 800-53 Rev 5 AC family; (d) NIST SP 800-162 ABAC; (e) NIST SP 800-207 Zero Trust; (f) NIST SP 800-63 Digital Identity Guidelines; (g) 3GPP TS 33.310 NDS/AF + TS 33.501 5G Security; (h) GSMA NESAS Network Equipment Security Assurance Scheme; (i) PCI DSS Req 7 + 8; (j) HIPAA Security Rule Access Control. (7) Modern Evolution: (a) Zero Trust replaces perimeter Access Control with continuous verification; (b) SASE Secure Access Service Edge integrates ZTNA Zero Trust Network Access with SD-WAN; (c) Identity-First Security for cloud-native; (d) Just-In-Time provisioning replacing standing privileges; (e) CIEM Cloud Infrastructure Entitlement Management; (f) Workload Identity for K8s + service mesh + SPIFFE/SPIRE. Coordinates with X.805 Layer 1/2/3 + Plane 1/2/3 + Threats Destruction/Corruption/Removal/Disclosure/Interruption + Security Dimension 2 Authentication (foundation for Access Control) + Security Dimension 6 Data Integrity (Access Control prevents unauthorized modification) + Security Dimension 8 Privacy (Access Control implements need-to-know). ITU-T X.805 Security Dimension 1 Access Control applies.
Maintained by Gerard Blokdyk·Verified against the published standard ·Control text last updated
What else in your programme already covers this
This control maps to 180 controls across 100 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.