The Information Protection Life Cycle and Framework: Control Access

The Information Protection Life Cycle (IPLC) and Information Protection Framework describe how information should be protected across three stages: acquire & assess, active use life, and disposition. The “main sequence” is Active Use Life, when information objects are actively used and therefore most exposed to access-related risks. Within this stage, the first major control category is Control Access, reflecting that information varies widely in intended openness: some content is deliberately public (e.g., Wikipedia under a Creative Commons license, works in the public domain), while other information is created to be restricted (e.g., trade secrets, contracts, copyrighted works, patents, PII, and financial statements). For sensitive information, access must be granular so that only authorized users on trusted devices can read, modify, or delete it.

Access control starts with authentication, which increasingly relies on contextual signals beyond user identity—device identity, environmental attributes (location, IP, geo-velocity, time), and session risk analytics informed by behavior and threat intelligence. Identity federation enables authentication to be trusted across domains. Despite substantial innovation and attention on authentication mechanisms (apps, push, hardware tokens, biometrics, FIDO, PKI), authentication is only the first step.

Authorization determines whether a user, app, or device may access specific resources. It has evolved from static ACLs to attribute- and policy-driven approaches that evaluate user, device, and resource metadata. Authorization is the core of access control, ranging from relatively simple consumer banking scenarios to stringent enterprise and government use cases, including Mandatory Access Control aligning classification with clearance. Standards and models include RBAC, ABAC, XACML, OAuth (and OpenID Connect/UMA), SAML, and LDAP, but heterogeneous and proprietary implementations create “last mile” integration challenges, especially for LOB applications.

Data Access Governance tools sustain control by validating classifications, managing ownership, normalizing permissions, recertifying access, detecting anomalies, monitoring changes and user patterns, and supporting request/approval workflows. Recommended actions include evaluating IPLC coverage, assessing authentication/authorization/governance capabilities across on-prem and cloud, and prioritizing control upgrades using risk management.

• The IPLC defines three stages for information objects: acquire & assess, active use life, and disposition.
• Active Use Life is a concept borrowed from archaeology describing the period when an artifact is actively in use.
• Wikipedia can be accessed without registration and is free to read due to its Creative Commons License.
• Works in the public domain have no copyright or their copyrights have expired.
• Access control begins with authentication and includes evaluation of contextual signals such as device identity and environmental attributes.
• Environmental attributes used in authentication commonly include location, IP addresses, geo-velocity, and date/time.
• Identity federation allows authentication events in one domain to be brokered and trusted by other domains.
• XACML is an OASIS standard that includes a reference model, distributed access control architecture, and policy markup language.
• OAuth is widely used in web applications and operates as a bearer token authorization method.
• LDAP became a de facto user attribute database decades ago and remains a core component in IAM architectures.

• “The ‘main sequence’ of information is Active Use Life, and Control Access is the first set of controls we consider.”
• “Not all information objects are created equal.”
• “Access to certain types of information must be granular, meaning only authorized users on trusted devices should be able to read, modify, or delete it.”
• “Increasingly, authentication includes a rich context encompassing not only user identity but also device identity, environmental attributes, and session-level risk analysis evaluating many other factors.”
• “However, authentication is just the first step in access control.”
• “Authorization is the core of access control.”
• “Authorization can vary widely in complexity.”
• “Access control can be difficult to implement across an enterprise due to the disparate kinds of systems involved, from on-premise to mobile to IaaS to SaaS apps.”
• “Authorization suffers from the Last Mile problem in that, though deploying a centralized access control solution may not be hard, connecting Line-of-Business (LOB) applications to it is often very hard.”
• “Monitor user access patterns and suggest changes to minimize access levels in accordance with principle of Least Privilege.”