When discussing access controls, which of the following terms describes the process of determining the activities or functions that an Individual is…

Authorization is the security process that determines a user's level of access or the specific permissions they have for a resource. This step occurs after a user has been successfully identified and authenticated. The system evaluates the user's identity against an access control policy to grant or deny permission to perform specific activities or functions, such as reading, writing, or executing a file. This directly matches the question's description of determining what an individual is permitted to do.

A. Authentication: This is the process of verifying a claimed identity (e.g., with a password or token), not determining the permissions associated with that identity.

B. Identification: This is the act of a user claiming an identity, typically by providing a username. It is the first step, preceding authentication and authorization.

D. Validation: This is a general term for confirming that data or an input is correct and meets predefined rules, not the specific access control process for granting permissions.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-162

Guide to Attribute Based Access Control (ABAC) Definition and Considerations.

Section 2.2

Page 6: Defines authorization as

"The process of determining

by evaluating applicable access control information

whether a subject is allowed to have the specified types of access to a particular resource."

2. Massachusetts Institute of Technology (MIT) OpenCourseWare

6.858 Computer Systems Security

Fall 2014.

Lecture 2: Controlling access to resources

Slide 4: Clearly distinguishes the concepts: "Authentication: who is the user? (principal)" and "Authorization: what is this user allowed to do? (policy)". This directly supports that authorization is about determining permitted actions.

3. National Institute of Standards and Technology (NIST) Interagency Report 7316

Assessment of Access Control Systems.

Section 2.1

Page 4: States

"The process of granting or denying specific requests for or attempts to... obtain and use information and related information processing services... is called authorization."