Section 17.164 Access Control Models Flashcards
Objectives 2.4 Given a scenario, you must be able to analyse indicators of malicious activity. Objectives 4.6 Given a scenario, you must be able to implement and maintain identity and access management.
Different Types of Access Control Models
Mandatory Access Control (MAC)
Uses security labels to authorise resource access
● Requires assigning security labels to both users and resources
● Access is granted only if the user’s label is equal to or higher than the resource’s label
Generally reserved for high security systems
Different Types of Access Control Models
Discretionary Access Control (DAC)
Resource owners specify which users can access their resources
● Access control based on user identity, profile, or role
● Allows resource owners to grant access to specific users
Different Types of Access Control Models
Role-Based Access Control (RBAC)
Assigns users to roles and assigns permissions to roles
● Roles mimic the organization’s hierarchy
● Enforces minimum privileges
● Effective for managing permissions based on job roles and turnover
Different Types of Access Control Models
Rule-Based Access Control
Uses security rules or access control lists
● Policies can be changed quickly and frequently
● Applied across multiple users on a network segment
Different Types of Access Control Models
Attribute-Based Access Control (ABAC)
Considers various attributes like…
User Attributes: User’s name, role, organization ID, or security clearance
Environment Attributes: Time of access, data location, and current organisations threat level
Resource Attributes: File creation date, resource owner, file name, and data sensitivity
● Access decisions are based on the combination of attributes
● Provides fine-grained control and dynamic access decisions
Access Control Extensions
Time-of-Day Restrictions
● Limits access based on specific time periods
● Often used to complement other access control models
● Helps prevent unauthorised access during non-working hours
Access Control Extensions
Principle of Least Privilege
● Users are granted the minimum access required to perform their job
functions
● Reduces the risk of misuse or accidental damage
● Regularly review and adjust permissions to prevent authorisation creep
