Access Control Models and Security Frameworks
Understand access control models including DAC, MAC, and RBAC that are essential for the CISA exam and IS audit practice.
Access Control Fundamentals
Access control is the process of granting or denying requests to obtain and use information and related services. It is one of the most important security controls an organization can implement. For CISA candidates, understanding access control models is critical because exam questions frequently test this topic.
Types of Access Control Models
Several formal models define how access is managed within an information system:
- Discretionary Access Control (DAC): The resource owner determines who can access the resource. DAC is flexible and commonly found in general-purpose operating systems. However, it relies on owners to make correct access decisions, which may lead to inconsistent or excessive permissions.
- Mandatory Access Control (MAC): Access decisions are based on security labels assigned to both subjects (users) and objects (resources). Users cannot change access controls or grant access to others. MAC is used in high-security environments such as military and government systems where strict data classification is required.
- Role-Based Access Control (RBAC): Access is granted based on organizational roles rather than individual identities. Users are assigned to roles, and roles are granted permissions. RBAC simplifies administration and supports the principle of least privilege. It is the most commonly implemented model in enterprise environments.
- Attribute-Based Access Control (ABAC): Access decisions are based on attributes of the user, resource, action, and environment. ABAC provides fine-grained control and supports complex access policies but requires more sophisticated infrastructure.
Access Control Principles
Several principles guide effective access control implementation:
- Least Privilege: Users should be granted only the minimum permissions necessary to perform their job functions. This limits the potential damage from both accidents and intentional misuse.
- Need to Know: Access to information should be restricted to those who require it for legitimate business purposes, even if they have the appropriate security clearance.
- Segregation of Duties: Critical functions should be divided among multiple individuals to prevent any single person from completing a sensitive transaction alone.
- Defense in Depth: Multiple layers of access controls should be implemented so that the failure of one control does not compromise the entire system.
Access Control Administration
Effective access control requires strong administrative processes:
- Provisioning: Granting access based on approved requests, verified by the resource owner or manager.
- Review: Periodically reviewing access rights to ensure they remain appropriate as roles and responsibilities change.
- Revocation: Promptly removing access when an employee transfers, changes roles, or leaves the organization.
Audit Considerations
IS auditors should evaluate whether the organization has implemented an appropriate access control model, whether access is granted based on documented approval, whether periodic access reviews are conducted, and whether terminated employee access is revoked promptly. Access control logs should be reviewed for unauthorized access attempts.
CISA Exam Tips
For the CISA exam, understand the characteristics of each access control model and when each is most appropriate. Know that RBAC is the most practical for enterprise environments, MAC provides the strongest control but is the most restrictive, and DAC is the most flexible but relies on owner judgment. Questions may present scenarios and ask you to recommend the most appropriate model.