Question
What's the difference between Zutrittskontrolle, Zugangskontrolle, and Zugriffskontrolle in German information-security terminology?
Answer
Three nested layers: Zutritt = physical (room/building), Zugang = logical system (login), Zugriff = data/operations (RWED on files).
The three German terms map to different layers of defence:
| Term | Layer | Example | English (rough) |
|---|---|---|---|
| Zutrittskontrolle | Physical access | Server room, badge readers, locks | Physical access control |
| Zugangskontrolle | Logical-system access | Logging in to an OS or application | Authentication / system access |
| Zugriffskontrolle | Data/operation access | Read/Write/Execute/Delete on a file | Authorisation / data access |
Why three distinct words exist: German information-security law and standards (e.g. older BDSG, BSI Grundschutz) historically distinguished these three because they need different controls — a guard at the data-centre door is a different control category than file ACLs. English collapses all three into "access control" and relies on context.
The bigger nesting: physical contains logical contains data — Zugriff can only happen if Zugang worked, Zugang only if Zutritt worked.
Tip: The three As of access control map straight onto the inner two layers plus oversight: Authentication (the Zugang/login check), Authorisation (the Zugriff/rights check), and Auditing/Logging (recording what was actually done).
Go deeper:
Access control (Wikipedia) — how physical, logical and data access layer up, and where authentication vs authorisation sit.
Note saved — thanks!
Question
What are the four sequential steps of access control, and what does each one answer?
Answer
Identifizierung → Authentifizierung → Autorisierung → Verantwortlichkeit. "Who claims to be there?" → "Are they really that person?" → "Are they allowed to do this?" → "What did they actually do?"
* The four sequential steps — each answers a different question, all governed by least privilege. *
| Step | Question | Example |
|---|---|---|
| Identifizierung (Identification) | Welcher Benutzer? — Who is claiming to be here? | Username, account ID, email |
| Authentifizierung (Authentication) | Ist der Benutzer wirklich der richtige? — Are they really that user? | Password, certificate, fingerprint |
| Autorisierung (Authorisation) | Was darf der Benutzer? — What may they do? | ACL check, RBAC role lookup |
| Verantwortlichkeit (Accountability) | Was hat der Benutzer getan? — What did they actually do? | Audit log, SIEM trail |
Why the order matters:
- You can't authenticate without identification (you need to know who you're verifying).
- You can't authorise without authentication (an unauthenticated user can't be granted rights).
- Accountability only exists if the first three worked — otherwise the log can't tell who did what.
Governing principle: Least privilege ('need-to-know'). A user should get the minimum rights required to do their job, no more. This caps the blast radius of any compromise: a stolen low-privilege account can't do high-privilege damage.
Go deeper:
- AAA (Authentication, Authorization, Accounting) (Wikipedia) — the standard security framing of these same steps.
Note saved — thanks!