Access control models (MAC, DAC, ABAC) in Cybersecurity - Deep Dive

Overview - Access control models (MAC, DAC, ABAC)

What is it?

Access control models are methods used to decide who can see or use resources in a computer system. They help protect sensitive information by controlling permissions. The main types are Mandatory Access Control (MAC), Discretionary Access Control (DAC), and Attribute-Based Access Control (ABAC). Each model uses different rules to manage access based on user identity, roles, or attributes.

Why it matters

Without access control models, anyone could access any data or system, leading to security breaches, data theft, or accidental damage. These models help organizations protect privacy, comply with laws, and keep systems safe from unauthorized use. They create clear rules so users only get access to what they need, reducing risks and building trust.

Where it fits

Before learning access control models, you should understand basic cybersecurity concepts like authentication and authorization. After mastering these models, you can explore advanced topics like role-based access control (RBAC), zero trust security, and identity management systems.

Mental Model

Core Idea

Access control models are structured rules that decide who can do what with which resources based on identity, ownership, or attributes.

Think of it like...

Imagine a library where different people have different permissions: some can borrow any book, some can only read in the library, and some can access special collections only if they meet certain criteria like membership level or age.

┌───────────────┐       ┌───────────────┐       ┌───────────────┐
│ Mandatory    │       │ Discretionary │       │ Attribute-    │
│ Access Control│       │ Access Control│       │ Based Access  │
│ (MAC)        │       │ (DAC)         │       │ Control (ABAC)│
└──────┬────────┘       └──────┬────────┘       └──────┬────────┘
       │                       │                       │       
       │ System-enforced       │ Owner decides          │ Uses user, resource,
       │ rules based on        │ who can access         │ and environment
       │ security labels       │ resources             │ attributes
       │                       │                       │
       ▼                       ▼                       ▼
  Access granted          Access granted          Access granted
  only if clearance       if owner permits       if attributes match
  matches label           access                 policy rules

Build-Up - 7 Steps

1

Foundation

What is Access Control?

Concept: Introduces the basic idea of controlling who can use or see resources.

Access control means setting rules to decide who can enter a room, use a computer file, or see information. It protects things from being used by the wrong people. Think of it like a lock on a door that only certain keys can open.

Result

You understand that access control is about protecting resources by limiting access.

Understanding access control is the foundation for all security systems because it defines the boundary between allowed and forbidden actions.

2

Foundation

Key Terms: Authentication and Authorization

Concept: Distinguishes between proving identity and granting permissions.

Authentication is proving who you are, like showing an ID card. Authorization is what you are allowed to do after proving your identity, like entering a specific room. Both are needed for access control to work properly.

Result

You can explain why knowing who someone is is different from what they can do.

Knowing the difference prevents confusion when designing or using access control systems.

3

Intermediate

Mandatory Access Control (MAC) Explained

🤔Before reading on: do you think users can change access permissions in MAC? Commit to yes or no.

Concept: Introduces MAC where the system strictly controls access based on labels.

In MAC, the system assigns security labels to users and data, like 'Top Secret' or 'Confidential.' Users cannot change these labels or permissions. Access is only allowed if the user's clearance matches or exceeds the data's label. This model is common in military and government systems.

Result

You understand that MAC enforces strict, system-controlled access rules that users cannot override.

Understanding MAC shows how strict control can protect highly sensitive information by removing user discretion.

4

Intermediate

Discretionary Access Control (DAC) Basics

🤔Before reading on: do you think in DAC the owner controls access or the system? Commit to owner or system.

Concept: Explains DAC where resource owners decide who can access their resources.

DAC lets the owner of a file or resource decide who else can use it. For example, a user can share a document with friends or keep it private. This model is common in personal computers and many business systems.

Result

You see that DAC gives flexibility but can be less secure if owners make poor choices.

Knowing DAC highlights the trade-off between user freedom and security risks.

5

Intermediate

Attribute-Based Access Control (ABAC) Overview

🤔Before reading on: do you think ABAC uses fixed roles or flexible attributes? Commit to fixed or flexible.

Concept: Introduces ABAC which uses multiple attributes to decide access dynamically.

ABAC checks many details like user role, time of day, location, and device type before allowing access. For example, a user might access data only during work hours from a company device. This model is flexible and powerful for complex environments.

Result

You understand ABAC as a dynamic, context-aware access control model.

Recognizing ABAC's flexibility helps appreciate modern security needs beyond simple ownership or labels.

6

Advanced

Comparing Strengths and Weaknesses

🤔Before reading on: which model do you think is most secure but least flexible? Commit to MAC, DAC, or ABAC.

Concept: Analyzes pros and cons of MAC, DAC, and ABAC for different use cases.

MAC is very secure but rigid, DAC is flexible but can be risky, and ABAC balances flexibility and security by using many attributes. Organizations choose based on their needs, like strict control for military or flexibility for businesses.

Result

You can recommend the right model depending on security and flexibility needs.

Understanding trade-offs guides better security design tailored to real-world requirements.

7

Expert

Challenges and Future of Access Control Models

🤔Before reading on: do you think traditional models easily handle cloud and mobile environments? Commit to yes or no.

Concept: Explores limitations of classic models and how modern systems evolve access control.

Traditional MAC and DAC struggle with cloud, mobile, and IoT because of dynamic users and devices. ABAC and newer models like policy-based and risk-adaptive access control address these challenges by using real-time data and machine learning to adjust permissions.

Result

You see why access control is evolving and how future systems improve security in complex environments.

Knowing these challenges prepares you to work with or design next-generation security systems.

Under the Hood

Access control models work by comparing attributes of users and resources against rules stored in the system. MAC uses fixed security labels and clearance levels enforced by the operating system kernel. DAC relies on access control lists (ACLs) managed by resource owners. ABAC evaluates multiple attributes dynamically using policies that combine user, resource, and environment data to grant or deny access.

Why designed this way?

MAC was designed for environments needing strict, non-negotiable security, like military, to prevent leaks. DAC was created for flexible, user-driven environments like personal computers. ABAC emerged to handle complex, dynamic environments where simple ownership or labels are insufficient, such as cloud computing and large enterprises.

┌───────────────┐       ┌───────────────┐       ┌───────────────┐
│ User Request  │──────▶│ Access Control│──────▶│ Resource      │
│ (User,       │       │ Decision      │       │ (Data, File)  │
│ Attributes)  │       │ Engine        │       │               │
└───────────────┘       └──────┬────────┘       └───────────────┘
                               │
        ┌──────────────────────┼───────────────────────┐
        │                      │                       │
   MAC: System checks     DAC: Owner checks       ABAC: Policy engine
   labels and clearance   ACLs set by owner       evaluates attributes
   enforced by system     permissions             dynamically

Myth Busters - 4 Common Misconceptions

Quick: In DAC, can any user change permissions on any file? Commit to yes or no.

Common Belief: Anyone can change access permissions on any file in DAC.

Reality: Only the owner or users with granted rights can change permissions in DAC, not everyone.

Why it matters: Believing otherwise can lead to overestimating risks or misconfiguring permissions.

Quick: Does MAC allow users to override system access rules? Commit to yes or no.

Common Belief: Users can override MAC rules if they have high enough clearance.

Reality: Users cannot override MAC rules; the system strictly enforces access based on labels.

Why it matters: Misunderstanding this can cause security gaps if users are trusted to change controls.

Quick: Is ABAC just a more complicated version of DAC? Commit to yes or no.

Common Belief: ABAC is simply a complicated form of DAC with more rules.

Reality: ABAC is fundamentally different because it uses multiple dynamic attributes and policies, not just ownership.

Why it matters: Confusing ABAC with DAC limits understanding of its flexibility and power in modern systems.

Quick: Does having more attributes in ABAC always mean better security? Commit to yes or no.

Common Belief: More attributes in ABAC always improve security.

Reality: Too many or poorly chosen attributes can complicate policies and cause errors or delays.

Why it matters: Overcomplicating ABAC policies can reduce usability and introduce security risks.

Expert Zone

1

MAC's strict enforcement can cause operational challenges, requiring careful label management to avoid blocking legitimate access.

2

DAC's flexibility often leads to 'permission creep' where users accumulate excessive rights over time, increasing risk.

3

ABAC policies must balance complexity and performance; overly complex policies can slow access decisions and confuse administrators.

When NOT to use

Avoid MAC in environments needing frequent changes or user flexibility; DAC is unsuitable for high-security needs; ABAC may be too complex for small systems where RBAC or simpler models suffice.

Production Patterns

Organizations often combine models: MAC for core sensitive data, DAC for user files, and ABAC for cloud services with dynamic conditions. Policy engines automate ABAC decisions, and auditing tools monitor DAC permissions to prevent abuse.

Connections

Role-Based Access Control (RBAC)

RBAC builds on DAC and ABAC by assigning permissions to roles rather than individuals or attributes.

Understanding access control models clarifies how RBAC simplifies management by grouping permissions, improving scalability.

Zero Trust Security

Zero Trust uses ABAC principles by continuously verifying attributes before granting access, regardless of network location.

Knowing ABAC helps grasp how Zero Trust enforces strict, dynamic access policies in modern networks.

Legal Privacy Frameworks (e.g., GDPR)

Access control models enforce data protection rules required by privacy laws by restricting who can access personal data.

Understanding access control is key to implementing compliance controls that protect user privacy and avoid legal penalties.

Common Pitfalls

#1 Giving users too many permissions in DAC.

Wrong approach:

User A sets file permissions to allow all users full access without restrictions.

Correct approach:

User A sets file permissions to allow only specific users or groups access as needed.

Root cause:

Misunderstanding that DAC requires careful permission assignment to avoid security risks.

#2 Ignoring label management in MAC.

Wrong approach:

Assigning all data the same security label regardless of sensitivity.

Correct approach:

Assigning accurate security labels to data based on sensitivity and clearance levels.

Root cause:

Underestimating the importance of precise labeling for effective MAC enforcement.

#3 Creating overly complex ABAC policies.

Wrong approach:

Writing ABAC policies with dozens of attributes and conditions that are hard to understand and maintain.

Correct approach:

Designing ABAC policies with essential attributes and clear, maintainable rules.

Root cause:

Believing more attributes always improve security without considering manageability.

Key Takeaways

Access control models define who can access resources and under what conditions, protecting systems from unauthorized use.

Mandatory Access Control (MAC) enforces strict, system-controlled rules based on security labels, ideal for high-security environments.

Discretionary Access Control (DAC) lets resource owners decide access, offering flexibility but requiring careful management.

Attribute-Based Access Control (ABAC) uses multiple dynamic attributes to make flexible, context-aware access decisions.

Choosing the right access control model depends on balancing security needs, flexibility, and operational complexity.