Access Control Models

Access Control Models

A reference for the access control models you need to know for the CISA exam. Understand each model's mechanism and when it is the best fit.

Model Comparison

Model	Full Name	Access Decided By	Best For
DAC	Discretionary Access Control	Resource owner	Small teams, file sharing
MAC	Mandatory Access Control	System-enforced labels	Military, classified data
RBAC	Role-Based Access Control	User's assigned role	Enterprises, most organizations
ABAC	Attribute-Based Access Control	Policies evaluating attributes	Complex, dynamic environments
Rule-Based	Rule-Based Access Control	Predefined rules (e.g., time of day)	Firewalls, network devices

Model Details

DAC (Discretionary)

• The data owner decides who gets access
• Uses Access Control Lists (ACLs)
• Most flexible but least secure model
• Vulnerable to Trojan horse attacks (programs inherit user's permissions)
• Example: Windows NTFS file permissions

MAC (Mandatory)

• Access based on security labels (classification levels)
• Users cannot change access permissions
• Most restrictive model
• Bell-LaPadula: "No read up, no write down" (confidentiality)
• Biba: "No read down, no write up" (integrity)

RBAC (Role-Based)

• Access based on the user's job function
• Simplifies administration for large organizations
• Supports separation of duties and least privilege
• Most commonly used model in enterprises
• Example: HR role can access payroll; IT role cannot

ABAC (Attribute-Based)

• Evaluates multiple attributes: user, resource, environment, action
• Most granular and flexible
• Policies can consider time, location, device type, and more
• Example: "Allow access if user is a manager, during business hours, from a corporate device"

Access Control Principles

Principle	Meaning
Least Privilege	Grant only the minimum permissions needed
Need to Know	Access only the information required for the task
Separation of Duties	No single person controls an entire critical process
Dual Control	Two or more people required to complete a task