Chapter 3:
Access Control Strategies
NB: This chapter presents only two strategies DAC and MAC. The other strategies are
presented in the Information Data Security module
What is Access Control in Cyberecurity?
Access Control is the set of security mechanisms, policies, and
processes that determine :
who is allowed to access
what resources in an information system
under which conditions.
Process that allows companies to determine who has access to
sensitive applications and data.
Ensures that the right people have the right access to the right
resources at the right time.
Why Access Control is Important?
Access control protects organizations by:
• Preventing unauthorized access
• Protecting sensitive data
• Enforcing the principle of least privilege
• Reducing insider and external attack risks
• Ensuring compliance (ISO 27001, GDPR,
HIPAA, etc.)
Components of Access Control
1. Identification
• The user claims an identity.
Example: entering a username or presenting an ID card.
2. Authentication
• The system verifies the user’s identity.
Example: passwords, biometrics, smart cards, MFA.
3. Authorization
• Once authenticated, the system decides:
• what the user is allowed to do,
• which files, services, or systems they may access.
4. Accounting / Auditing
• Activities are logged and analyzed to detect misuse.
Example: SIEM logs, access logs.
Components of Access Control
Access Control Models
1. Discretionary Access Control (DAC)
• Owner of the resource decides who can access it.
• Flexible but less secure.
2. Mandatory Access Control (MAC)
• Access decisions are based on classification labels (Top Secret,
Secret, Confidential).
• Common in military/government systems.
• Very strict.
3. Role-Based Access Control (RBAC)
• Access is assigned to roles (Admin, Manager, Analyst).
• Users inherit privileges from their assigned roles.
• Most used model in enterprises.
Access Control Models
4. Attribute-Based Access Control (ABAC)
• Decisions are based on attributes:
1. user attributes (department, position)
2. environmental attributes (time, location)
3. resource attributes (confidentiality)
• Very flexible; used in cloud and Zero Trust.
5. RBAC + ABAC Hybrid (PBAC — Policy-Based)
• Combines roles with rules/attributes.
• Used in modern IAM systems.
6. Rule-Based Access Control
• Access determined by predefined rules (firewall ACLs, network
rules).
Access Control Models – Discretionary Access Control (DAC)
Discretionary Access Control is a decentralized access control
policy that allows subjects to control access to objects. DAC can e
found in smartphone apps, Google Docs, and Operating Systems
worldwide.
In DAC, subjects can
Share information with other users.
Grant privileges to others.
Change object attributes, or choose which attributes are
associated with newly created objects.
Set different forms of access control without central
authorization.
Access Control Models – Discretionary Access Control (DAC)
DAC Concepts
Subjects: users or user groups seeking access to resources protected by DAC.
Object: a system resource such as an application, or a piece of data stored on
the network.
Access Control Models – Discretionary Access Control (DAC)
Main types of DAC
1. Access control lists (ACLs): an access control list is a document
that contains information about authorized users. This allows
administrators to set rule-based access control systems for
each object. ACLs include user identities and the privileges
that each user possesses. They can also be linked to user
groups as part of role-based access control systems.
2. Capability systems: an access is related to the identity of the
object being accessed. For example, cryptocurrency owners
can access their currency if they possess a private key. Imgur
users can edit objects if they have the hidden URL for each
image.
Access Control Models – Discretionary Access Control (DAC)
When a user creates a file or object:
1. The system automatically assigns the user as owner.
2. The owner can grant or deny permissions such as:
read
write
execute
delete
modify
This is usually managed through:
• ACLs (Access Control Lists)
• Permissions attributes (Linux rwx model)
Access Control Models – Discretionary Access Control (DAC)
Benefits of DAC
Flexibility: users can share resources easily. Object owners can
divide users into groups, creating fine-grained controls over access
settings.
Simple : users can grant object access with the click of a button.
There is no need to create complex user profiles or clearance
levels for new hires.
Simple policy management: all admins need to do is assign object
access privileges to users. With the right ACL management
systems, discretionary access technology is extremely simple to
use
Access Control Models – Discretionary Access Control (DAC)
Challenges of DAC
• Less secure: DAC is recognized as less secure than other access
control methods. DAC can allow attackers to implant malware
on target access points. Prone to malware spreading when a
compromised user shares access.
• Lack of visibility: decentralization can lead to confusion and
poor administrative visibility. Security teams need to know who
is accessing sensitive resources. Discretionary controls are hard
to monitor and control, leading to security gaps and compliance
issues. No centralized control (owners decide, not the
organization).
• Not suitable for high-security environments (military,
government).
Access Control Models – Discretionary Access Control (DAC)
Real Examples of DAC
1. Windows File Sharing
A user can right-click a folder and choose who can read or edit it.
2. Linux Permissions
Users can change permissions using chmod, chown, chgrp.
Social media
Facebook groups are managed via a form of discretionary access
control. Group owners can determine who has access to content
hosted on each group. Group members generally have a restricted
ability to transfer content and share it outside the Facebook
platform.
Access Control Models – Discretionary Access Control (DAC)
Real Examples of DAC
4. Smartphone apps
When you allow apps to access your smartphone, you are using
discretionary access systems. The smartphone owner determines
which applications can access functions like the contacts directory
or GPS.
5. Collaboration platforms
Productivity tools like Dropbox or Google Docs use DAC to set user
access to files. For example, the owner of a Google Document
could create an ACL including relevant employees. Some members
of the group are given write functions, while others may only be
able to view the file. And the owner retains the power to delete
the document or close the project.
Access Control Models
Mandatory access control (MAC)
Access Control Models – Mandatory access control (MAC
• Mandatory access control (MAC) is a centralized access
control system. MAC regulates access to resources based on
the clearance levels of users and the attributes of objects
they seek to access.
• Users cannot change permissions on the objects they own.
Access is determined based on security labels, such as
classification levels.
• With MAC users can have different levels of authorization
depending on their position and role. Admins can assign
different sensitivity levels to data or applications, depending
on security needs
The system decides who can access what, not the user.
Access Control Models – Mandatory access control (MAC
MAC concepts
Administrators determine clearance levels and user groups from
a central control panel. They do so by creating security labels for
objects, and assigning privilege levels to network users.
Access Control Models – Mandatory access control (MAC
MAC concepts
Label-based security (Clearance levels and security categories)
Both subjects (users/processes) and objects (files/data) have labels, such as:
• Top Secret
• Secret
• Confidential
• Public
Access is granted based on label comparison.
Administrators can also place objects in security categories. For example,
classified data at security level 5 may be assigned to a specific project. In this
case, users with level 5 clearance credentials can access the data. But they
must also be members of the project. The system will deny access to level 5
users not assigned to the project.
Access Control Models – Mandatory access control (MAC
MAC concepts
Access rules follow strict mandatory policies, such as:
Bell–LaPadula model (confidentiality-focused)
"No read up" (a Secret user cannot read Top Secret data)
"No write down" (prevents leakage of classified data)
Biba model (integrity-focused)
"No write up"
"No read down"
Access Control Models – Mandatory access control (MAC
Benefits of MAC
• Very strong security controls. The system administrator can set
access permissions for objects anywhere on the network. Users
without the necessary clearance level cannot access these
objects.
•
Prevents data leakage or unauthorized sharing.
•
Enforces organizational policies automatically.
• Clear visibility for system administrators. Centralized access
controls make it easier to track who is connected to network
assets.
• Ideal for classified or sensitive environments
Access Control Models – Mandatory access control (MAC
Challenges of MAC
• Complexity and problems with implementation. Administrators
can struggle to maintain MAC systems as user communities
grow.
• Not flexible for dynamic environments.
• Weak protection against insider threats. MAC protects against
many attacks. But it is vulnerable to insider threats. Users with
access to administrative privileges can bypass controls or grant
access to outsiders.
Access Control Models – Mandatory access control (MAC
Implementing MAC
1. Central admins define security classifications and groups (such
as projects or departments). This forms the basis for each
security label.
2. Administrators assign security attributes to each object. Each
security label includes a clearance level and security category.
3. Each user account is given security attributes appropriate for
their role. This includes clearances and group memberships.
4. When users access objects, the operating system compares
their credentials to the MAC database. If they have the right
attributes, the system grants access. If not, controls will deny
access or request additional authentication information.