What principle states access decisions should be based on permissions rather than exclusions?

• A. Fail-Safe Defaults
• B. Least Privilege
• C. Separation of Privilege
• D. Open Design

Answer: (A)

The principle that states access decisions should be based on permissions rather than exclusions is known as Fail-Safe Defaults. This principle emphasizes that when considering system access controls, permissions should be explicitly granted to users for specific resources rather than allowing access by default and needing to explicitly deny it.

In practical terms, if a system is designed with fail-safe defaults, it ensures that users can access only what they are authorized to access, which reduces the risk of unauthorized access to sensitive data. By focusing on permissions, organizations can ensure that access control mechanisms operate under the premise of least risk, allowing users only the privileges they need to perform their tasks while keeping sensitive information secure.

This approach contrasts with other principles like Least Privilege, which focuses on limiting users' access to the bare minimum necessary for their roles, and Separation of Privilege, which involves dividing control of a resource among different users to reduce risks. Open Design, on the other hand, promotes security through transparency and accountability, but does not specifically address the nature of access decisions in relation to permissions versus exclusions.