1. Access control refers to controlling access by a user to a computer system, or data on that system. In formal terms, a "subject" (e.g. a user) attempts to access the "object" (e.g. system or data). An access control system will evaluate the security levels of the subject and object in order to see if access is permitted. Example: A simple example is the case where you enter a username and password in order to log onto the computer. Contrast: mandatory access control The system gives users "clearance levels", and assigns sensitivity levels to information. Therefore, if you only have "secret" clearance level, you cannot access "top-secret" information, but you can access "secret" or "confidential" information. See: Bell-LaPadula Model for more information. discretionary access control This system assigns subjects (users) to one or more groups. An object (system or file) contains a DACL (discretionary access control list) enumeration which users and groups may access the object. See: Access Control List for more information. Key point: There are different kinds of access. Read access means that somebody can read information, whereas write access implies that that somebody can change the data. For example, you can get a copy of your credit report and read it, but you can't necessarily change the data. From Hacking-Lexicon