In this lesson,
we're going to explore access control models.
There are many different types of access control models,
but in this lesson, we will focus on the five primary models
which are known as mandatory access control,
discretionary access control, role-based access control,
rule-based access control,
and attribute-based access control.
Then we will also review a few other types
of access control restrictions,
such as time of day restrictions
and the implementation of least privilege.
The first model we have is known as
mandatory access control, also known by its acronym as MAC.
Mandatory access control uses security labels
to determine which users are authorized
to access a particular resource.
This type of access control is complex to configure
and more expensive to maintain, therefore,
it is generally reserved for high security systems.
Under this system, anything that is not specifically allowed
is considered forbidden and is not accessible by the users.
For this system to work effectively, every single user
and resource must be assigned a security label.
If the user's level is not equal
or higher to the resource's level,
then the user is blocked from accessing that resource.
For example, if you're working for the military
and you have been labeled as having a secret clearance,
you can access anything on the system
that is labeled secret, confidential,
or unclassified since your secret clearance
is at or above these three levels.
But if you try to access a file labeled as top secret
in a Mac-based system, you will be denied access
since your secret clearance is lower
than the required top secret clearance
needed to view that file.
The second model is known as discretionary access control,
or DAC.
With discretionary access control,
a resource's owner is allowed to specify
which user can access each resource.
Using discretionary access control,
the access is determined based on a user's identity,
profile, or role, and this is considered
a form of need to know access control.
For example, if you decided to share a file on your computer
with me over the corporate network,
you could easily use discretionary access control
by adding my username to the authorized users
under your file sharing settings
for that one file or folder.
The third model is known as role-based access control.
Role-based access control allows an administrator
to assign each user to one or more roles,
and then use those roles to assign permissions
to the organization's resources.
In Windows domain environment, role-based access control
is normally implemented by using groups,
and these groups can also be set up in the structure
that mimics your organizational hierarchy.
For example, we might create one group
for the accounting department
and another group for the human resources department.
Based on those groups or roles, we can assign each group
with access to different resources.
Additionally, we could put both of these groups
into a higher level group called employees
that has access to other resources
that every employee might need access to.
Role-based access control can be used
to enforce minimal privileges for a subject
based on all of the associated groups,
and users can be members of one
or more groups based on those roles.
This type of access control works well for organizations
with a high rate of employee turnover
since permissions are based on work role
rather than an individual's username.
The fourth model is known as rule-based access control.
Rule-based access control allows administrators
to implement security policies across all of their users.
This allows for the use of rules
that may be changed quickly and frequently.
For example, access control lists are set up on routers
and firewalls as a form of rule-based access control,
and when they are implemented,
they affect all users on the given network segment.
The fifth model is known as an attribute-based
access control, or ABAC.
Attribute-based access control
relies on a set of characteristics of an object
to make an access control decision.
User attributes include things like the user's name,
role, organization. ID, or security clearance level.
Environment attributes include things
like the time of access, the location of the data,
and the current organization's threat level.
Resource attributes include things like the creation date
of the file or object, the resource owner,
the file name, and the data sensitivity.
Depending on these various users, environment,
or resource attributes, access is permitted or denied
to the individual requesting access.
For example, our company's SharePoint site on our intranet
may look different when we log in to it from our account
than it does when our coworkers log in based on
what access rules are applied to our individual accounts
and where we are logging in from,
either from the corporate office or from our home office.
So now that we have an understanding
of the five basic models used in access control,
let's take a quick look at time of day restrictions
and the implementation of least privilege.
With time of day restrictions,
access control can limit access to resources
based off the time of day that the request is made.
This type of restriction is often used in conjunction
with other access control models
to provide an additional layer of security.
For example, your organization
might have regular working hours of 8:00 AM
to 6:00 PM daily, and if someone tries to log in
to their workstation at 2:00 AM,
this could be blocked since it's outside
of the normal working hours for your organization.
This rule will therefore only provide access
to our organization systems during a specific time period,
and by configuring time of day restrictions,
you can prevent insider threat based on malicious activity
since none of your users will have access to the system
during irregular hours when malicious activity
is most often carried out.
Finally, let's take a look at the principle
of least privilege.
The principle of least privilege is a cybersecurity concept
that states the user is given the minimal levels
of access necessary to complete his or her job functions,
and nothing additional.
This principle is usually applied
by choosing one of the five access control models
we covered in this lesson, and they are then used
to restrict the permissions granted to users,
systems, and processes to the bare minimum
necessary to perform their intended functions.
For example, a user who only needs to read data
from a database should not have the ability
to write or modify data contained in that database
by limiting the user privileges in this way.
The potential damage that they can cause
either intentionally or unintentionally
is greatly minimized.
Another benefit of using least privilege
is that it can help to mitigate the risk
of an account being able to conduct a lot of actions
if it was to become compromised by a threat actor.
Another aspect of least privilege that you should implement
is the continual review of your user's permissions
to ensure that permissions or authorization creep
is not occurring.
Permission or authorization creep
refers to the situation where a user acquires
more and more rights as they move from one position
to another within the company.
And eventually, they will have entirely too much access
across your enterprise network
based on their current job role.
For example, if I just hired a new employee
named Samantha to work in our student support department,
she would be granted access to that department's
permissions levels, including access
to our student support systems, billing system,
learning management system, and some others,
but she would not have access to our production team's files
or have the same levels of permission as they do.
Now, if Samantha gets a promotion
and moves to our business development department,
she will get new permissions
that match her new job function in that department,
but if we don't remove her old permissions,
she will now have permissions for both the student support
and the business development departments.
Now, let's fast forward another 12 months,
and now Samantha finished a bunch of training
and has become a full stack web developer.
She also applies for a new position
and gets one in our software development team.
Now she has three sets of permissions,
but this violates the principle of least privilege.
So when she accepts her promotion
and moves into the software development team,
her old permissions from the student support group
and the business development department
should be revoked to maintain high levels of data security
for our systems and its sensitive data.
So remember, when it comes to access control,
you have five different types that you can implement,
mandatory access control, discretionary access control,
role-based access control, rule-based access control,
and attribute-based access control.
With mandatory access control, or MAC,
the user is granted or denied access
based on the policies dictated by the central authority.
With discretionary access control, or DAC,
the owner of the information or resource
determines who can access it.
With role-based access control, or RBAC,
the access permissions are based
on the roles within the given organization.
With rule-based access control, also abbreviated as RBAC,
user access is granted or denied
based on a set of rules defined by a system administrator.
With attribute-based access control, or ABAC,
the user's access is granted or denied
based on the attributes associated
with a user, an action, or a resource.
Also, access controls can have limits
placed on the user's access to resources
based on the time of day that a request is made.
Finally, we cover the principle of least privilege,
which is a cybersecurity concept that states
that a user is given the minimum levels
of access necessary to complete his or her job functions
or work role, and nothing additional.
By configuring proper access control on your network,
you can ensure that your enterprise network
and systems are well protected against unauthorized access.