Reading into information security, I noticed two branches. Access control when communication with external device by using some type of cryptographic authentication and encryption mechanism and things like control flow integrity. My question is why do we need the latter if former is good enough. Are there example of control flow exploits on access control protocol implementation themselves? My focus is mainly on embedded devices.
Control flow integrity and buffer over flow protection are measures against exploiting coding bugs in a program. Access control is about controlling who can access some device or application etc.
By assuming that access control would be sufficient you assume that a) access control itself is perfect and never has any bugs and b) access control makes sure that only innocent users will be able to access the remote device/application. You therefore conclude that the remote device/application can have lots of bugs since no hacker will even be able to reach the buggy code in order to exploit it.
Both assumptions are wrong: a) access control can have bugs like other software and b) some hacker might hack into the trusted client and is therefore treated as authorized to access the remote device/application. And the hacker will not be friendly to a buggy application.