Depth of Access: Measuring Data Permission Levels in InfoSec

Definition

Depth of access quantifies the extent to which a user, process, or system can view, modify, or delete data without additional authorization. It represents the vertical privilege level within a data hierarchy.

Typical Scale (0–10)

Determinants

• Role-based access control (RBAC): Job function defines baseline.
• Attribute-based (ABAC): Context (time, location, device) refines depth.
• Principle of least privilege: Grant minimum depth needed.

Security Importance

• Limits blast radius of compromise (insider threat, credential theft).
• Enables audit trails and anomaly detection.
• Regulatory compliance (GDPR, HIPAA, SOX) requires documented access depths.

Regular access reviews and just-in-time elevation are best practices.