Access control models (MAC, DAC, ABAC) in Cybersecurity - Step-by-Step Execution

Concept Flow - Access control models (MAC, DAC, ABAC)

User Requests Access

↓

Check Access Control Model

↓

MAC

↓

Access Granted or Denied Based on Model Rules

When a user requests access, the system checks which model applies (MAC, DAC, or ABAC) and then decides access based on rules, ownership, or attributes.

Execution Sample

Cybersecurity

User requests file access
System checks MAC labels
System checks DAC ownership
System checks ABAC attributes
System grants or denies access

This sequence shows how a system processes an access request using MAC, DAC, and ABAC models.

Analysis Table

Step	Access Control Model	Check Performed	Condition	Access Decision
1	MAC	Check user and object security labels	User label >= Object label	Access Granted
2	MAC	Check user and object security labels	User label < Object label	Access Denied
3	DAC	Check if user is owner or has permission	User is owner or permission granted	Access Granted
4	DAC	Check if user is owner or has permission	User is not owner and no permission	Access Denied
5	ABAC	Evaluate user, resource, environment attributes	Attributes satisfy policy rules	Access Granted
6	ABAC	Evaluate user, resource, environment attributes	Attributes do not satisfy policy rules	Access Denied

💡 Access decision made based on model-specific checks and conditions.

State Tracker

Variable	Start	After Step 1	After Step 3	After Step 5	Final
User Label	Low	Low	Low	Low	Low
Object Label	Medium	Medium	Medium	Medium	Medium
User Ownership	No	No	Yes	Yes	Yes
User Attributes	Role=User	Role=User	Role=User	Role=Admin	Role=Admin
Access Decision	None	Denied	Granted	Granted	Granted

Key Insights - 3 Insights

Why does MAC deny access when user label is lower than object label?

Because MAC enforces strict rules based on security labels; if the user's clearance is lower than the object's classification, access is denied as shown in execution_table step 2.

How does DAC differ in deciding access compared to MAC?

DAC bases access on ownership and permissions set by the owner, not on fixed labels. As seen in steps 3 and 4, if the user owns the resource or has permission, access is granted.

What makes ABAC more flexible than MAC and DAC?

ABAC uses multiple attributes (user role, time, location) to decide access dynamically, allowing complex policies as shown in steps 5 and 6.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does MAC deny access?

A Step 1

B Step 2

C Step 3

D Step 5

💡 Hint

Check the 'Access Decision' column for MAC model steps.

According to variable_tracker, what is the User Ownership after Step 3?

A Yes

B Unknown

C No

D Low

💡 Hint

Look at the 'User Ownership' row under 'After Step 3' column.

If the user attributes change to Role=Guest, how would ABAC's access decision change in execution_table?

A No change in access decision

B Access Granted at Step 5

C Access Denied at Step 6

D Access Granted at Step 3

💡 Hint

Refer to ABAC steps 5 and 6 where attributes affect access.

Concept Snapshot

Access Control Models:
- MAC: System-enforced, based on security labels.
- DAC: Owner-controlled, based on permissions.
- ABAC: Attribute-based, flexible policies using user/resource/environment attributes.
Access is granted or denied by checking these rules when a user requests access.

Full Transcript

Access control models determine how systems decide if a user can access a resource. Mandatory Access Control (MAC) uses fixed security labels and strict rules, denying access if the user's clearance is lower than the object's classification. Discretionary Access Control (DAC) lets resource owners decide who can access their resources, granting access if the user is the owner or has permission. Attribute-Based Access Control (ABAC) uses multiple attributes like user role, resource type, and environment conditions to make flexible access decisions. When a user requests access, the system checks the relevant model's rules and grants or denies access accordingly.

Practice

1. Which access control model uses labels and system-enforced rules to restrict access?

easy

A. Mandatory Access Control (MAC)

B. Discretionary Access Control (DAC)

C. Attribute-Based Access Control (ABAC)

D. Role-Based Access Control (RBAC)

Solution

1. Step 1: Understand MAC characteristics

   MAC uses labels and system rules to control access, not user choice.

2. Step 2: Compare with other models

   DAC lets owners decide, ABAC uses attributes, RBAC uses roles. Only MAC uses labels and system rules.

3. Final Answer:

   Mandatory Access Control (MAC) -> Option A

4. Quick Check:

   Labels + system rules = MAC [OK]

Hint: Labels and system rules mean MAC model [OK]

Common Mistakes:

• Confusing DAC with MAC because both control access
• Thinking ABAC uses labels like MAC
• Mixing RBAC roles with MAC labels

2. Which of the following correctly describes Discretionary Access Control (DAC)?

easy

A. Access is based on predefined roles within an organization

B. Access is controlled by system-enforced labels only

C. Access is granted based on user attributes like time and location

D. Resource owners decide who can access their resources

Solution

1. Step 1: Recall DAC definition

   DAC allows resource owners to decide who can access their resources.

2. Step 2: Eliminate other options

   System-enforced labels describe MAC, attributes describe ABAC, roles describe RBAC.

3. Final Answer:

   Resource owners decide who can access their resources -> Option D

4. Quick Check:

   Owner control = DAC [OK]

Hint: Owner decides access means DAC model [OK]

Common Mistakes:

• Confusing DAC with MAC which uses system labels
• Mixing ABAC attributes with DAC
• Assuming roles control DAC access

3. Consider this scenario: A system grants access to a file only if the user's department matches the file's department attribute and access time is within business hours. Which access control model is this an example of?

medium

A. Mandatory Access Control (MAC)

B. Discretionary Access Control (DAC)

C. Attribute-Based Access Control (ABAC)

D. Role-Based Access Control (RBAC)

Solution

1. Step 1: Identify key access factors

   Access depends on user attributes (department) and conditions (time).

2. Step 2: Match model to attribute-based rules

   ABAC uses attributes like department and time to decide access.

3. Final Answer:

   Attribute-Based Access Control (ABAC) -> Option C

4. Quick Check:

   Attributes + conditions = ABAC [OK]

Hint: Attributes and conditions point to ABAC model [OK]

Common Mistakes:

• Choosing MAC because of strict rules
• Confusing RBAC roles with attributes
• Thinking DAC controls by owner only

4. A company uses a system where users can share files and decide who else can access them, but the system also enforces security labels on files that cannot be changed by users. What is the error in this access control setup?

medium

A. It does not enforce any access control

B. It mixes DAC and MAC models incorrectly

C. It allows users to override system labels

D. It uses ABAC without defining attributes

Solution

1. Step 1: Analyze the setup

   Users control sharing (DAC), but system enforces labels (MAC).

2. Step 2: Identify conflict

   Mixing DAC and MAC can cause conflicts because MAC labels cannot be overridden by users.

3. Final Answer:

   It mixes DAC and MAC models incorrectly -> Option B

4. Quick Check:

   Mixing DAC and MAC causes conflicts [OK]

Hint: DAC owner control conflicts with MAC system labels [OK]

Common Mistakes:

• Assuming ABAC is used without attributes
• Thinking users can override MAC labels
• Ignoring the presence of enforced labels

5. An organization wants to implement an access control system that allows access based on user role, time of day, and location, but also requires that certain highly sensitive files can only be accessed by users with a specific security clearance label. Which combination of access control models best fits this requirement?

hard

A. Mandatory Access Control (MAC) combined with Attribute-Based Access Control (ABAC)

B. Discretionary Access Control (DAC) combined with Role-Based Access Control (RBAC)

C. Role-Based Access Control (RBAC) only

D. Attribute-Based Access Control (ABAC) only

Solution

1. Step 1: Identify requirements

   Access depends on role, time, location (attributes) and security clearance labels (system-enforced).

2. Step 2: Match models to requirements

   ABAC handles attributes like role, time, location; MAC enforces security clearance labels.

3. Step 3: Combine models for full coverage

   Using MAC with ABAC covers both label enforcement and attribute-based conditions.

4. Final Answer:

   Mandatory Access Control (MAC) combined with Attribute-Based Access Control (ABAC) -> Option A

5. Quick Check:

   Labels + attributes = MAC + ABAC [OK]

Hint: Combine MAC labels with ABAC attributes for complex control [OK]

Common Mistakes:

• Choosing RBAC only, missing label enforcement
• Using DAC which lacks system labels
• Assuming ABAC alone handles security labels