Dover Castle
Dover castle, built by King Henry II, was a way to control physical access.
Author: Jake Keup. Source: Wikimedia Commons. License: CC BY 2.0.
Access control is the process by which permissions are granted for given resources. Access control can be physical (e.g., locked doors accessed using various control methods) or logical (e.g., electronic keys or credentials). There are several access control models, to include:
- Role-based access control: Access is granted based on individual roles.
- Mandatory access control: Access is granted by comparing data sensitivity levels with user sensitivity access permissions.
- Attribute-based access control: Access is granted based on assigned attributes.
- Discretionary access control: Access is granted based on the identity and/or group membership of the user.
The access control model used is determined based on the needs of the organization. To determine the best model, a risk assessment should be performed to determine what threats might be applicable. This information is then used to assess which model can best protect against the threats.
Resources
Required
- Security Information in Production and Operations: A Study on Audit Trails in Database Systems
- State of the Art Authentication, Access Control, and Secure Integration in Smart Grid
- Broken Access Control
- An Introduction to Role-Based Access Control
- Guide to Attribute-Based Access Control
- Database Security & Access Control Models: A Brief Overview
- Access Control as a Service for the Cloud
Recommended
- Trust-Based Access Control Model from Sociological Approach in Dynamic Online Social Network Environment
- Dynamic Access Control Model for Security Client Services in Smart Grid
- Assessment of Access Control Systems
- A Survey of Access Control Models
- OWASP Top 10 for .NET Developers Part 3: Broken Authentication and Session Management
Check Your Knowledge
Choose the best answer to each question:
Question
1
When a user can dynamically (or selectively) assign privileges for other users of the system, this is called which of the following access control models?
SoD
MAC
RBAC
DAC
Tasks and associated privileges to perform the tasks are assigned based on organizational responsibilities for purposes of internal controls in separation of duties. Try again.
In mandatory access control, access rights are controlled by the operating system, based on an individual or entity's security attributes. Try again.
Roles and privileges based on separation of responsibilities are used to control access in role-based access control. Try again.
That's correct. Discretionary access control (DAC) enables access to be assigned or restricted based on the identity of subjects and/or their association with specific group(s).
Question
2
When a retail company places access control policies in place for its cashiers, it has implemented which of the following types of policies?
role-based policy
identity-based policy
mandatory access policy
separation of duties policy
That's correct. This is a role-based policy because the retail company is granting access based on the employee's role as a cashier. Role-based access control (RBAC) is an approach to restricting system access to authorized users.
An identity-based policy would grant access requiring authentication of an individual. Try again.
A mandatory access policy would grant access requiring the matching of sensitivity labels (classifications) for the user and the object and is controlled through the operating system. Try again.
A separation of duties policy deals with the integrity of information as opposed to access control. Try again.
Question
3
A sensitivity level attached to an object must contain which of the following in mandatory access control?
the item's classification
the item's classification and category set
the item's category
the item's need to know
The item's classification is one of the required components of MAC, but it is not the complete answer. Try again.
That's correct. The item's classification and category set are required in order to implement mandatory access control. This information informs the system, which then determines the type of access allowed for an object based on established policies.
The item's category is one of the required components of MAC, but it is not the complete answer. Try again.
Need to know applies to the subject, not to the object, and therefore is not correct for this statement. Try again.
Question
4
When controlling access to an object by a subject, security professionals must set up access rules. The following are the three access control models that can be used to set up these rules.
mandatory, discretionary, nondiscretionary
role-based, identity-based, attribute-based
MAC, DAC, RBAC
none of the above
That's correct. Mandatory, discretionary, and nondiscretionary access controls allow the establishment of access rules to restrict or allow access.
Role-based, identity-based, and attribute-based models determine access based on an entity's role, identity, or associated attributes, respectively, and not based on access rules. This statement is not correct. Try again.
MAC and DAC do establish access controls based on access rules, but RBAC does not. This statement is not correct. Try again.
One of the options listed is correct. Try again.
Question
5
Rule-based access control (RuBAC) access is determined by rules that are in which of the following categories?
discretionary access control (DAC)
role-based access control (RBAC)
nondiscretionary access control (NDAC)
identity-based access control
Discretionary access control allows the individual to determine access of objects he or she owns. It is not determined by rules. This statement is not correct. Try again.
Access is determined based on roles, not rules, in role-based access control. This statement is not correct. Try again.
That's correct. Nondiscretionary access control dynamically assigns access based on rules.
Identity-based access control determines access based on identity, not rules. This statement is not correct. Try again.
Question
6
Which of the following is the category with rules that are not established by user preferences and can only be changed administratively?
nondiscretionary access control
discretionary access control
mandatory access control
system-based access control
That's correct. Nondiscretionary access control uses a subject's role or a task assigned to the subject to establish rules that grant or deny object access.
Discretionary access control uses the identity of the subject to decide when to grant an access request, and all access to an object is defined by the object owner and not user preferences. This statement is not correct. Try again.
Mandatory access control assigns a security label to each subject and object and matches the label of the subject to the label of the object to determine when access should be granted. It is not based on user preferences. This statement is not correct. Try again.
System-based access control determines access based on rules established for the system and is not based on user preferences. This statement is not correct. Try again.
Question
7
Which of the following is true of the mandatory access control environment?
The system or security administrator will define the permissions for subjects.
The administrator does not dictate the user's access.
The administrator configures the proper level of access as dictated by the data.
all of the above
This is a correct but incomplete characterization of the MAC environment. This statement alone is incorrect. Try again.
This is a correct but incomplete characterization of the MAC environment. This statement alone is incorrect. Try again.
This is a correct but incomplete characterization of the MAC environment. This statement alone is incorrect. Try again.
The MAC environment requires the system or security administrator to define the permissions, and it does not allow the administrator to dictate the user's access but rather requires the administrator to configure the appropriate level of access as determined by the data. This statement is correct.
Question
8
Which of the following is defined as the dominance relationship of the MAC system?
The security clearance of the subject is reviewed and compared with the object sensitivity level or classification level.
The security clearance of the subject is not important because the system provides authorization.
The security clearance of the subject is compared with the separation of duties policy, and access is provided.
The security clearance of the subject has to be at the highest level of top secret.
In mandatory access control, access is determined by matching the security clearance of the subject to the sensitivity or classification level of the object. This statement is correct.
This is incorrect. The security clearance of the subject is key to the MAC environment, as it provides one requirement (the other being the classification of the object) in order to determine access. Try again.
This is incorrect. Duties/roles of subjects do not impact the MAC environment but rather the security clearance of the subject. Try again.
The MAC environment does not prescribe the level of security clearance but rather only that a level is identified so that it can be matched to the sensitivity or classification of the object. This statement is not correct. Try again.
Question
9
Which of the following is not an access control technique?
remote access controls
discretionary access control
mandatory access control
role-based access control
There is no access control technique by this name. This statement is correct.
Discretionary access control is a control technique that uses the identity of the subject to decide when to grant an access request, and all access to an object is defined by the object owner. This statement is not correct. Try again.
Mandatory access control is a control technique that assigns a security label to each subject and object and matches the label of the subject to the label of the object to determine when access should be granted. This statement is not correct. Try again.
Role-based access control is a control technique that restricts system access to authorized users based on their role. This statement is not correct. Try again.
Question
10
In some access control models, the data owner or resource owner can specify access to resources based on identity. Which of the following access control models does this describe?
discretionary access control
mandatory access control
identity-based access control
rule-based access control
That's correct. Discretionary access control uses the identity of the subject to decide when to grant an access request.
Mandatory access control assigns a security label to each subject and object and matches the label of the subject to the label of the object to determine when access should be granted. It is not based on identity. This statement is incorrect. Try again.
This is not an access control model. This statement is not correct. Try again.
Rule-based access control assigns access based on rules, not identity. This statement is not correct. Try again.
Question
11
As the name implies, which of the following access control models is an example of DAC based on the characteristic of the user?
role-based access control
rule-based access control
identity-based access control
mandatory access control
Role-based access control uses roles to define access and is therefore not an example of DAC, which restricts access based on the identity of an individual or group(s) to which they belong. This statement is not correct. Try again.
Rule-based access control uses rules to define access and is therefore not an example of DAC, which restricts access based on the identity of an individual or group(s) to which they belong. This statement is not correct. Try again.
This statement is correct. Identity-based access control uses the identity of the subject to decide when to grant an access request, and it is therefore an example of discretionary access control, which restricts access based on the identity of an individual or group(s) to which they belong.
Mandatory access control assigns a security label to each subject and object and matches the label of the subject to the label of the object to determine when access should be granted. It is not an example of DAC, which restricts access based on the identity of an individual or group(s) to which they belong. This statement is not correct. Try again.
Licenses and Attributions
Chapter Twelve: Western Europe and Byzantium circa 1000-1500 CE from World History: Cultures, States, and Societies to 1500 by Berger et al. is available under a Creative Commons Attribution-ShareAlike 4.0 International license. UMGC has modified this work and it is available under the original license.