Authorization determines what an established identity may access or do. Access-control policies turn that decision into permissions for particular resources and circumstances, so people can reach the information they need without receiving unnecessary access. section 7.1 section 7.1.7
Choose an access-control model that fits the organization’s resources and security needs:
- Discretionary access control lets a resource owner grant permissions; poor owner decisions can create risk. section 7.1.2
- Mandatory access control applies centralized policies and classification labels that users cannot change. section 7.1.2
- Role-based access control assigns permissions through organizational roles. section 7.1.2
- Attribute-based access control evaluates policy against user, resource, and environmental attributes, such as role, information type, or access time. section 7.1.2
Table 7.2 Unique features of different access controls models
| DAC |
MAC |
RBAC |
ABAC |
|
| Restrictiveness |
Low |
High |
Medium |
Medium |
| Control |
High |
Low |
Medium |
Medium |
| Flexibility |
Low |
Low |
High |
High |
| Policy maker |
Owner |
System |
Roles |
Attributes |
| Advantages |
Easy privilege configuration |
Highly secure |
Supports large enterprises Mitigates damage to data |
Automated trust negotiation Improves on RBAC |
| Disadvantages |
Low storage capacity Unauthorized privileges can be granted |
Low storage capacity Unable to modify security levels |
Privileges depend on role |
Requires investigation for defining attributes relevant to authorization decisions |
Compare the four models by who sets policy, how restrictive they are, and their stated advantages and disadvantages before choosing one. section 7.1.2
Permissions need maintenance after the initial decision. Grant access during onboarding, adjust it when roles change, and revoke it during offboarding. Apply least privilege and audit controls regularly so permissions continue to match duties, data sensitivity, and business needs. section 7.1 section 7.1.7
When an access rule fails
At a life sciences company, failed login attempts preceded unauthorized access to restricted patient data. An investigation found a configuration error despite an access-management alert. The executive report recorded 15 access-control violations and a three-hour average response time against a one-hour target. Corrective actions included adjusting policies, tuning anomaly detection, and automating escalations; reported violations fell to zero after remediation. section 3.4.2
