Access Control Models

Question 1

Discretionary Access Control (DAC)

Answer 1

Concept: Access granted based on user identity.
Owner Control: The resource owner determines access.
Example: File permissions on a shared drive.

Question 2

Mandatory Access Control (MAC)

Answer 2

Concept: Access determined by comparing user and data labels (clearances).
Security Labels: Assigned to both data and users.
Example: Military or government systems.

Question 3

Role-Based Access Control (RBAC)

Answer 3

Concept: Permissions based on user roles, not individual identities.
Efficiency: Simplifies access management.
Example: Assigning roles (e.g., admin, user) in an organization.

Question 4

Lattice-Based Access Control

Answer 4

Concept: Access is based on security classes or security labels.
A subject can read and write to an object that has the same security class. A subject cannot access an object that has a higher security class.