Access Control Schemes

In a mandatory access control (MAC) implementation

users do not have the ability to grant access to files or otherwise change the security policies that are set centrally

In a discretionary access control (DAC) implementation

the owners of a file (or directory) can set permissions that apply to the owner, the group, or the world, and they can choose to allow the file to be read, modified, or executed

Role-based access control (RBAC)

systems rely on roles that are then matched with privileges that are assigned to those roles. ____ systems boil down to three primary rules:

• Role assignment, which states that subjects can use only permissions that match a role they have been assigned

• Role authorization, which states that the subject’s active role must be authorized for the subject

• Permission authorization, which states that subjects can use only permissions that their active role is allowed to use

Rule-based access control

is applied using a set of rules, or access control lists (ACLs), that apply to various objects or resources

Attribute-based access control (ABAC)

relies on policies that are driven by attributes of the users

Time-of-day restrictions

which limit when activities can occur

Least privilege

the concept that accounts and users should only be given the minimum set of permissions and capabilities necessary to perform their role or job function