Certopolis

CompTIA Security+ (SY0-801)

Access control models: MAC vs DAC vs RBAC vs ABAC

Mandatory access control grants access by comparing a label on the data with the user's clearance, and users cannot pass access on. Discretionary access control lets the owner decide who gets access. Role-based grants permissions through job roles, attribute-based evaluates attributes of the user, object and environment, and rule-based changes privileges automatically when a rule's condition is met.

Mandatory vs discretionary

The NIST glossary defines mandatory access control (MAC) as restricting access based on the sensitivity of information, shown by a label, and the user's formal clearance. A subject with access cannot pass the information on, grant its privileges to others, or change security attributes. A central authority decides, not the owner.

Discretionary access control (DAC) leaves access to the discretion of the object's owner, who decides who gets access and what rights they have. A subject with access can pass information on or grant its privileges to others.

Role-based and attribute-based

SP 800-53 Rev. 5 describes role-based access control (RBAC) as enforcing access based on the subject's defined role, that is, job function. Users assigned to a role inherit its privileges, so privileges are not assigned to each user directly.

SP 800-162 defines attribute-based access control (ABAC) as granting or denying requests based on attributes of the subject, attributes of the object, environment conditions, and a policy written in terms of those attributes.

Rule-based changes

SP 800-53 control AC-2(6), dynamic privilege management, describes changing user privileges by dynamic rules instead of editing individual user profiles. Its examples include adjusting privileges when users work outside normal hours or when systems are under duress. A rule that strips remote access from every account when the threat level is severe fits this description.

Where the exam catches people

  • Believing the data owner controls access under MAC: labels and clearances decide, and users cannot grant access to others.
  • Believing role-based and rule-based are the same: roles map job functions to permissions, while rules change privileges when a condition is met, for every account the rule covers.
  • Believing DAC means no control: the owner sets access, and holders can pass rights on, which is exactly what MAC prevents.
  • Believing ABAC looks only at the user: it evaluates subject attributes, object attributes and environment conditions together.

Written from CompTIA's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. A defense contractor labels each file by sensitivity. Users may open a file only if their clearance covers its label, and no user can grant another user access. Which of the following access control models is in use?

    Right. In the game that’s Renown for your Security Operations building.

    Not that one: C is right. In the game your Security Operations building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    Under SP 800-53 Rev. 5 a subject granted access cannot pass the information or its privileges to others. Labels, clearances and no owner grants describe mandatory access control.

    Written from csrc.nist.gov/glossary/term/mandatory_access_control

  2. On a shared project server, the employee who creates a folder decides which colleagues may read or change it and can pass those rights to anyone. Which of the following access control models does this describe?

    Right. In the game that’s Renown for your Security Operations building.

    Not that one: D is right. In the game your Security Operations building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    A subject can also pass information or grant its privileges to others. The folder creator deciding and passing on rights is discretionary access control.

    Written from csrc.nist.gov/glossary/term/discretionary_access_control

  3. When a company's SIEM raises the threat level to severe, the access system automatically removes remote access privileges from every account until the level drops, without anyone editing individual accounts. Which of the following access control models does this describe?

    Right. In the game that’s Renown for your Security Operations building.

    Not that one: D is right. In the game your Security Operations building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    A system-wide condition that automatically removes remote access from every account is rule-based access control.

    Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf