Authorization Models: RBAC, ABAC, MAC, DAC
Compare authorization models including RBAC, ABAC, MAC, and DAC, with practical audit guidance for CISA exam candidates.
Understanding Authorization
Authorization determines what actions an authenticated user is permitted to perform and what resources they can access. For CISA candidates, understanding different authorization models is crucial because the choice of model directly affects how effectively an organization can enforce access control policies. Auditors must evaluate whether the authorization model in use is appropriate for the organization's security requirements and whether it is properly implemented.
Authorization is distinct from authentication: authentication verifies who you are, while authorization determines what you can do. Effective authorization enforces the principle of least privilege by limiting access to only what is necessary for each user's role.
Discretionary Access Control (DAC)
In a DAC model, the resource owner determines who can access the resource. Common in desktop operating systems and file shares, DAC allows owners to grant or revoke permissions at their discretion. Key characteristics include:
- Resource owners control access permissions
- Flexible but difficult to manage consistently across large organizations
- Risk of excessive permissions if owners grant access too broadly
- Access control lists (ACLs) are the typical implementation mechanism
Auditors should assess whether DAC implementations result in overly permissive access and whether ownership is clearly defined and maintained.
Mandatory Access Control (MAC)
MAC enforces access based on security labels assigned to both subjects (users) and objects (resources). Access is granted only when the subject's clearance level meets or exceeds the object's classification level. Key features include:
- Centrally managed by security administrators, not resource owners
- Based on security classifications (e.g., Unclassified, Confidential, Secret, Top Secret)
- Commonly used in military and government environments
- Provides strong enforcement of information flow controls
The Bell-LaPadula model ("no read up, no write down") and the Biba model (focused on integrity) are formal MAC models that CISA candidates should understand.
Role-Based Access Control (RBAC)
RBAC assigns permissions to roles rather than individual users, and users are then assigned to appropriate roles. This model simplifies access management in large organizations:
- Role definition: Roles are created based on job functions and responsibilities
- Permission assignment: Access rights are associated with roles, not individuals
- User assignment: Users are assigned to one or more roles based on their position
- Role hierarchy: Senior roles can inherit permissions from junior roles
Auditors should evaluate whether role definitions reflect actual job functions, whether users are assigned only to roles they need, and whether role assignments are reviewed regularly.
Attribute-Based Access Control (ABAC)
ABAC makes access decisions based on attributes of the user, the resource, the action, and the environment. This model provides fine-grained, context-aware access control:
- User attributes: Department, clearance level, location, time of access
- Resource attributes: Classification, owner, type, sensitivity
- Environmental attributes: Time of day, network location, device type
- Policy rules: Boolean logic combining attributes to determine access decisions
Audit Approach
When auditing authorization controls, IS auditors should evaluate the appropriateness of the chosen model for the organization's needs, test whether permissions are correctly implemented, verify that the principle of least privilege is enforced, and assess whether authorization decisions are logged for accountability. Comparing actual access permissions against authorized access levels helps identify unauthorized privilege accumulation.