4.6a access control models

Access control

Enforcing policies that allow or disallow access to data, applied to individuals or groups, after authentication has already occurred.

Least privilege (reinforced)

Users get exactly the rights needed for their job, nothing more, limiting damage if malicious software runs under that user's context.

Mandatory Access Control (MAC)

Resources are labeled (confidential, secret, top secret); a central administrator defines what access level each user is granted.

Discretionary Access Control (DAC)

The creator or owner of the data decides who else can access it and at what permission level (read vs modify).

Role-Based Access Control (RBAC)

Access tied to job function or role; administrator creates groups, assigns permissions to the group, then adds users, who inherit permissions implicitly.

Rule-Based Access Control

Administrator creates system-enforced rules tied to specific objects (time-based access, browser requirements, etc.); the user has no control over the rules.

RBAC vs Rule-Based

RBAC bases access on who you are (role/group). Rule-Based bases access on conditions being met (time, location, device), independent of who the person is.

Attribute-Based Access Control (ABAC)

Access determined by combining multiple criteria at once: IP address, time of day, action type, relationship to the data. The most granular, "next generation" model.

ABAC as combination model

ABAC evaluates identity, time, location, action, and more simultaneously, effectively combining what RBAC and Rule-Based each check separately.

Time-of-day restriction

A specific access condition, usable across multiple models, limiting access to certain hours; not a model on its own.

Time zone consideration

For global organizations, time-of-day restrictions must account for the user's native time zone, not just server local time.

DAC tradeoff

High flexibility since the owner controls access, but lower security since consistency depends on individual user judgment rather than central policy.

MAC administrator control

Unlike DAC, the administrator, not the data owner, defines all access levels in a mandatory access control system.

Access control model summary

DAC: owner decides. MAC: labels, central admin. RBAC: role/group. Rule-Based: conditions. ABAC: multiple combined attributes.