Access Controls - CompTIA Security+ SY0-701 - 4.6

Access Control Mechanisms

Understanding Access Control

• Access control is essential after user authentication, determining who can access specific resources based on job functions.

• Policies define what resources users need access to, which IT teams implement through operating system processes.

Types of Access Control Models

• The principle of least privilege ensures users receive only the permissions necessary for their roles, minimizing potential damage from malicious software.

• Mandatory Access Control (MAC) assigns labels (e.g., confidential, secret) to resources, with administrators defining user permissions based on these labels.

Discretionary and Role-Based Access Controls

• Discretionary Access Control (DAC) allows data creators to set permissions for others, providing flexibility but potentially less security due to reliance on individual users.

• Role-Based Access Control (RBAC) assigns permissions based on job roles. Administrators create groups (e.g., managers, directors), assigning rights that apply to all group members.

Rule-Based Access Control

• In Rule-Based Access Control, system-enforced rules dictate user access without individual control over permissions.

Access Control Models Understanding Attribute-Based Access Control

Overview of Attribute-Based Access Control

• Attribute-based access control (ABAC) is a modern style of access control that utilizes various criteria to determine data access.

• ABAC allows for complex rule sets, evaluating multiple factors such as IP address, time of day, action type (read/write), and user relationship to the data.

Criteria for Access Determination

• Administrators can combine different criteria to establish specific controls over data objects, enhancing security and flexibility in access management.

• Time-based restrictions are one method used in ABAC, allowing or denying access based on the time of day or week.

Challenges with Time-Based Restrictions

• Implementing time restrictions can be complicated for global organizations due to varying time zones; administrators must consider users' local times when configuring access.