Access control models (MAC, DAC, ABAC) in Cybersecurity - Mini Project: Build & Apply

Understanding Access Control Models: MAC, DAC, and ABAC

📖 Scenario: You are working in a company that needs to manage who can access different files and resources securely. To do this, you will learn about three common access control models used in cybersecurity: Mandatory Access Control (MAC), Discretionary Access Control (DAC), and Attribute-Based Access Control (ABAC).Each model controls access in a different way, and understanding them helps protect sensitive information.

🎯 Goal: Build a simple reference guide that lists examples of resources and shows how each access control model would manage access to those resources.This guide will help you understand the differences between MAC, DAC, and ABAC by seeing how they apply to real-world situations.

📋 What You'll Learn

Create a dictionary called resources with three entries: 'File1', 'File2', and 'File3', each with a description string.

Create a variable called user_attributes that holds a dictionary with keys 'role' and 'department' and their values.

Create a dictionary called access_policies that maps each access control model name ('MAC', 'DAC', 'ABAC') to a short explanation string.

Add a final dictionary called access_examples that shows for each resource which access control model would allow access based on the user's attributes.

💡 Why This Matters

🌍 Real World

Access control models are essential in cybersecurity to protect sensitive data by controlling who can see or change information.

💼 Career

Understanding MAC, DAC, and ABAC is important for roles like security analyst, system administrator, and IT auditor to design and manage secure systems.

1

Create the resources dictionary

Create a dictionary called resources with these exact entries: 'File1': 'Confidential financial report', 'File2': 'Employee contact list', and 'File3': 'Project design document'.

Cybersecurity

# Create the resources dictionary with exact entries
# Your code here

Need a hint?

Use curly braces {} to create a dictionary with the exact keys and values given.

2

Add user attributes dictionary

Create a dictionary called user_attributes with keys 'role' set to 'Manager' and 'department' set to 'Finance'.

Cybersecurity

resources = {
    'File1': 'Confidential financial report',
    'File2': 'Employee contact list',
    'File3': 'Project design document'
}
# Create the user_attributes dictionary with role and department
# Your code here

Need a hint?

Remember to use the exact keys and values as shown.

3

Define access control model explanations

Create a dictionary called access_policies with these exact entries: 'MAC' mapped to 'Access based on fixed security labels', 'DAC' mapped to 'Access controlled by resource owner', and 'ABAC' mapped to 'Access based on user attributes and policies'.

Cybersecurity

resources = {
    'File1': 'Confidential financial report',
    'File2': 'Employee contact list',
    'File3': 'Project design document'
}

user_attributes = {
    'role': 'Manager',
    'department': 'Finance'
}
# Create the access_policies dictionary with MAC, DAC, and ABAC explanations
# Your code here

Need a hint?

Use the exact keys and descriptions for each access control model.

4

Create access examples dictionary

Create a dictionary called access_examples with keys 'File1', 'File2', and 'File3'. Set 'File1' to 'MAC', 'File2' to 'DAC', and 'File3' to 'ABAC' to show which access control model allows access for the user.

Cybersecurity

resources = {
    'File1': 'Confidential financial report',
    'File2': 'Employee contact list',
    'File3': 'Project design document'
}

user_attributes = {
    'role': 'Manager',
    'department': 'Finance'
}

access_policies = {
    'MAC': 'Access based on fixed security labels',
    'DAC': 'Access controlled by resource owner',
    'ABAC': 'Access based on user attributes and policies'
}
# Create the access_examples dictionary mapping each file to the access control model
# Your code here

Need a hint?

Match each file to the correct access control model as instructed.