jperezduerto.info
Security in depth · Unit 26 · Lesson 1 of 4
A route is not a permission
Read three access checks without confusing connectivity, identity, and resource authority.
Helpful before thisPivoting, proxies, and network boundaries
After this lesson you can
- Locate the failed access boundary in a supplied record without broadening another boundary.
One idea. One situation. One reasoned decision.
How it works
A route tells a system where to send traffic. It does not establish the user’s authority to access the destination. Network controls, service authentication, and resource authorization remain necessary. When documenting an approved access path, distinguish reachability from the permission to use it and describe which systems enforce each boundary. This makes access changes easier to review and reverse.
Which boundary made the decision?
A fictional archive uses a network gateway, a sign-in service, and document permissions. The records below are supplied review observations, not instructions to contact a system.
| Record | Network and identity evidence | Resource result |
|---|---|---|
| R1 | Connection reached the service; user signed in | Document Q denied |
| R2 | No permitted network path from the test location | Application not reached |
| R3 | Connection reached the service; user signed in | Document P allowed |
Worked decision: R1 demonstrates connectivity and accepted identity for that request. Its denial belongs to the resource-access decision. Compare Q’s intended permission rule with the caller’s actual entitlement before deciding whether the denial is correct. Expanding network access would not answer that question.
R2 cannot establish how the application would authorize the request because the record never reaches that stage. R3 establishes the allowed result for P under its recorded conditions; it does not extend permission to Q.
Document the caller, resource, action, location, and time for each conclusion. A professional review can preserve an expected denial while still identifying a separate availability or configuration issue. Treating every unsuccessful request as the same problem loses the evidence needed to choose the right correction.
The key distinction: Network paths and application permissions answer different questions.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
What should the reviewer investigate first for R1?
Show the answer
Correct answer: Q’s intended access rule and the caller’s entitlement for the requested action. Those facts determine whether this resource denial is expected. Connectivity and sign-in have already been observed for R1.
Try it
- WriteWrite a disposition for R1 and R2. Identify the relevant owner and the evidence needed to distinguish an expected denial from an incorrectly applied resource rule.