Access control models (MAC, DAC, ABAC) in Cybersecurity - Mini Project: Build & Apply

Understanding Access Control Models: MAC, DAC, and ABAC

📖 Scenario: You are working in a company that needs to manage who can access different files and resources securely. To do this, you will learn about three common access control models used in cybersecurity: Mandatory Access Control (MAC), Discretionary Access Control (DAC), and Attribute-Based Access Control (ABAC).Each model controls access in a different way, and understanding them helps protect sensitive information.

🎯 Goal: Build a simple reference guide that lists examples of resources and shows how each access control model would manage access to those resources.This guide will help you understand the differences between MAC, DAC, and ABAC by seeing how they apply to real-world situations.

📋 What You'll Learn

Create a dictionary called resources with three entries: 'File1', 'File2', and 'File3', each with a description string.

Create a variable called user_attributes that holds a dictionary with keys 'role' and 'department' and their values.

Create a dictionary called access_policies that maps each access control model name ('MAC', 'DAC', 'ABAC') to a short explanation string.

Add a final dictionary called access_examples that shows for each resource which access control model would allow access based on the user's attributes.

💡 Why This Matters

🌍 Real World

Access control models are essential in cybersecurity to protect sensitive data by controlling who can see or change information.

💼 Career

Understanding MAC, DAC, and ABAC is important for roles like security analyst, system administrator, and IT auditor to design and manage secure systems.

1

Create the resources dictionary

Create a dictionary called resources with these exact entries: 'File1': 'Confidential financial report', 'File2': 'Employee contact list', and 'File3': 'Project design document'.

Cybersecurity

# Create the resources dictionary with exact entries
# Your code here

Hint

Use curly braces {} to create a dictionary with the exact keys and values given.

2

Add user attributes dictionary

Create a dictionary called user_attributes with keys 'role' set to 'Manager' and 'department' set to 'Finance'.

Cybersecurity

resources = {
    'File1': 'Confidential financial report',
    'File2': 'Employee contact list',
    'File3': 'Project design document'
}
# Create the user_attributes dictionary with role and department
# Your code here

Hint

Remember to use the exact keys and values as shown.

3

Define access control model explanations

Create a dictionary called access_policies with these exact entries: 'MAC' mapped to 'Access based on fixed security labels', 'DAC' mapped to 'Access controlled by resource owner', and 'ABAC' mapped to 'Access based on user attributes and policies'.

Cybersecurity

resources = {
    'File1': 'Confidential financial report',
    'File2': 'Employee contact list',
    'File3': 'Project design document'
}

user_attributes = {
    'role': 'Manager',
    'department': 'Finance'
}
# Create the access_policies dictionary with MAC, DAC, and ABAC explanations
# Your code here

Hint

Use the exact keys and descriptions for each access control model.

4

Create access examples dictionary

Create a dictionary called access_examples with keys 'File1', 'File2', and 'File3'. Set 'File1' to 'MAC', 'File2' to 'DAC', and 'File3' to 'ABAC' to show which access control model allows access for the user.

Cybersecurity

resources = {
    'File1': 'Confidential financial report',
    'File2': 'Employee contact list',
    'File3': 'Project design document'
}

user_attributes = {
    'role': 'Manager',
    'department': 'Finance'
}

access_policies = {
    'MAC': 'Access based on fixed security labels',
    'DAC': 'Access controlled by resource owner',
    'ABAC': 'Access based on user attributes and policies'
}
# Create the access_examples dictionary mapping each file to the access control model
# Your code here

Hint

Match each file to the correct access control model as instructed.

Practice

1. Which access control model uses labels and system-enforced rules to restrict access?

easy

A. Mandatory Access Control (MAC)

B. Discretionary Access Control (DAC)

C. Attribute-Based Access Control (ABAC)

D. Role-Based Access Control (RBAC)

Solution

1. Step 1: Understand MAC characteristics

   MAC uses labels and system rules to control access, not user choice.

2. Step 2: Compare with other models

   DAC lets owners decide, ABAC uses attributes, RBAC uses roles. Only MAC uses labels and system rules.

3. Final Answer:

   Mandatory Access Control (MAC) -> Option A

4. Quick Check:

   Labels + system rules = MAC [OK]

Hint: Labels and system rules mean MAC model [OK]

Common Mistakes:

• Confusing DAC with MAC because both control access
• Thinking ABAC uses labels like MAC
• Mixing RBAC roles with MAC labels

2. Which of the following correctly describes Discretionary Access Control (DAC)?

easy

A. Access is based on predefined roles within an organization

B. Access is controlled by system-enforced labels only

C. Access is granted based on user attributes like time and location

D. Resource owners decide who can access their resources

Solution

1. Step 1: Recall DAC definition

   DAC allows resource owners to decide who can access their resources.

2. Step 2: Eliminate other options

   System-enforced labels describe MAC, attributes describe ABAC, roles describe RBAC.

3. Final Answer:

   Resource owners decide who can access their resources -> Option D

4. Quick Check:

   Owner control = DAC [OK]

Hint: Owner decides access means DAC model [OK]

Common Mistakes:

• Confusing DAC with MAC which uses system labels
• Mixing ABAC attributes with DAC
• Assuming roles control DAC access

3. Consider this scenario: A system grants access to a file only if the user's department matches the file's department attribute and access time is within business hours. Which access control model is this an example of?

medium

A. Mandatory Access Control (MAC)

B. Discretionary Access Control (DAC)

C. Attribute-Based Access Control (ABAC)

D. Role-Based Access Control (RBAC)

Solution

1. Step 1: Identify key access factors

   Access depends on user attributes (department) and conditions (time).

2. Step 2: Match model to attribute-based rules

   ABAC uses attributes like department and time to decide access.

3. Final Answer:

   Attribute-Based Access Control (ABAC) -> Option C

4. Quick Check:

   Attributes + conditions = ABAC [OK]

Hint: Attributes and conditions point to ABAC model [OK]

Common Mistakes:

• Choosing MAC because of strict rules
• Confusing RBAC roles with attributes
• Thinking DAC controls by owner only

4. A company uses a system where users can share files and decide who else can access them, but the system also enforces security labels on files that cannot be changed by users. What is the error in this access control setup?

medium

A. It does not enforce any access control

B. It mixes DAC and MAC models incorrectly

C. It allows users to override system labels

D. It uses ABAC without defining attributes

Solution

1. Step 1: Analyze the setup

   Users control sharing (DAC), but system enforces labels (MAC).

2. Step 2: Identify conflict

   Mixing DAC and MAC can cause conflicts because MAC labels cannot be overridden by users.

3. Final Answer:

   It mixes DAC and MAC models incorrectly -> Option B

4. Quick Check:

   Mixing DAC and MAC causes conflicts [OK]

Hint: DAC owner control conflicts with MAC system labels [OK]

Common Mistakes:

• Assuming ABAC is used without attributes
• Thinking users can override MAC labels
• Ignoring the presence of enforced labels

5. An organization wants to implement an access control system that allows access based on user role, time of day, and location, but also requires that certain highly sensitive files can only be accessed by users with a specific security clearance label. Which combination of access control models best fits this requirement?

hard

A. Mandatory Access Control (MAC) combined with Attribute-Based Access Control (ABAC)

B. Discretionary Access Control (DAC) combined with Role-Based Access Control (RBAC)

C. Role-Based Access Control (RBAC) only

D. Attribute-Based Access Control (ABAC) only

Solution

1. Step 1: Identify requirements

   Access depends on role, time, location (attributes) and security clearance labels (system-enforced).

2. Step 2: Match models to requirements

   ABAC handles attributes like role, time, location; MAC enforces security clearance labels.

3. Step 3: Combine models for full coverage

   Using MAC with ABAC covers both label enforcement and attribute-based conditions.

4. Final Answer:

   Mandatory Access Control (MAC) combined with Attribute-Based Access Control (ABAC) -> Option A

5. Quick Check:

   Labels + attributes = MAC + ABAC [OK]

Hint: Combine MAC labels with ABAC attributes for complex control [OK]

Common Mistakes:

• Choosing RBAC only, missing label enforcement
• Using DAC which lacks system labels
• Assuming ABAC alone handles security labels