ACCESS

CONTROL MODELS
Presented By:
LAVANYA CHHABRA (11021210045)
ADITI (11021210014)
Section: D
WHAT IS ACCESS CONTROL ?
Access control is a fundamental component of data security that dictates
who’s allowed to access and use company information and resources.

Authentication is the process of verifying who someone is, whereas

authorization is the process of verifying what specific applications, files, and
data a user has access to.

Through authentication and authorization, access control policies make sure

users are who they say they are and that they have appropriate access to
company data. Access control can also be applied to limit physical access to
campuses, buildings, rooms, and datacenters.

Access control can be as simple as a door with a lock on it. Access control
allows you to manage who enters your property and at which time they are
allowed to do so.
ACCESS
CONTROL MODEL
Access Control Models allow organizations to grant user
permissions and enforce access policies.

There are five types of access control models:

1. Attribute-Based Access Control (ABAC)
2. Discretionary Access Control (DAC)
3. Mandatory Access Control (MAC)
4. Role-Based Access Control (RBAC)
5. Rule-Based Access Control (RBAC or RB-RBAC)

A method is chosen based on the level of access needed

by each user, security requirement, infrastructure, etc.
ATTRIBUTE-BASED ACCESS CONTROL
It is also referred to as policy-based access control (PBAC) or claims-based
access control (CBAC).

Attribute-based access control (ABAC) is an authorization model that

evaluates attributes (or characteristics), rather than roles, to determine
access.

OR

It is an authorization methodology that sets and enforces policies based on

characteristics, such as department, location, manager, and time of day.

The purpose of ABAC is to protect objects such as data, network devices, and
IT resources from unauthorized users and actions—those that don’t have
“approved” characteristics as defined by an organization’s security policies.
HOW IT WORKS ?
ABAC grants permissions according to who a user is
rather than what they do, which allows for granular
controls. Attributes are analyzed to assess how they
interact in an environment; then, rules are enforced
based on relationships.

An access request is made.

The attribute-based access control tool scans attributes

to determine if they match existing policies.

Based on the result of the ABAC tool’s analysis,

permission is granted or denied.
COMPONENTS
OF ABAC
Attributes are the characteristics or values of components that are used in an access event.
These attributes can be drawn from several data sources. Attribute-based access control
allows the use of multiple attributes for authorization to provide a more granular
approach to access control
Attributes can be:

1) Subject or user attributes

Subject or user attributes describe who is attempting to obtain access to a resource in
order to act. These can include username, age, job title, citizenship, user ID,
department and company affiliation, security clearance, management level, and other
identifying criteria. ABAC systems can collect this information from authentication
tokens used during login, or it can be pulled from a database or system (e.g., an LDAP,
HR system).
2) Object or resource attributes
Object or resource attributes encompass characteristics of an object or resource (e.g., file,
application, server, API) that has received an access request. Examples of object or
resource attributes are creation date, last updated, author, owner, file name, file type, and
data sensitivity.

3) Environmental or context attributes

Environmental attributes indicate the broader context of access requests. Environmental
attributes can be a variety of contextual items, such as the time and location of an access
attempt, the subject’s device type, communication protocol, authentication strength, the
subject’s normal behavior patterns, the number of transactions already made in the past
24 hours, or even relationship with a third party.

4) Action attributes
Action attributes indicate how a user wants to engage with a resource. Examples of
common action attributes in access requests are view, read, write, copy, edit, transfer,
delete, or approve. These can be used individually or in combination for more complex
scenarios.
EXAMPLE
Let's say you have a system where employees can access certain documents based
on their department, role, and location.
ATTRIBUTES RULES
User attributes: Department (e.g., HR, Only HR department employees can
Finance), Role (e.g., Manager, access payroll documents.
Employee), Location (e.g., Office A, Managers can access budget
Office B) documents for their respective
Resource attributes: Document type departments.
(e.g., Payroll, Budget), Sensitivity level Employees working remotely can only
(e.g., Public, Confidential) access public documents.
Access to confidential documents
requires multi-factor authentication.

Using these attributes and rules, the system can dynamically determine who has access to
what documents based on their specific attributes and the conditions set in the access control
policies. This provides a more flexible and fine-grained approach to access control compared
to traditional methods.
PROS OF ABAC
Specific Access: ABAC lets you control who can access what very precisely.

Adaptable Access: It can change access based on things like the time of day or
where someone is trying to access from.

Works with Lots of People and Things: ABAC can handle a big crowd of users
and resources without getting confused.

You Can Make Your Own Rules: You get to decide what traits matter for access,
giving you a lot of flexibility.

Keeps Everything in Check: It helps you follow rules and keeps track of who's
doing what for audits.
CONS OF ABAC
Complicated Setup: Setting up ABAC can be tricky because you have to define a
lot of rules and traits.

Uses a Lot of Resources: It can take up a lot of computer power, especially if

you have a ton of users and resources.

Needs Regular Attention: You have to keep updating and managing all the
traits and rules, which can be a hassle.

Can Be Misused: If you're not careful with how you set it up, it might let the
wrong people in.

Compatibility Issues: Sometimes, it might not work well with older systems or
other security measures you already have in place.
DISCRETIONARY ACCESS CONTROL MODEL
Discretionary access control is an identity-based access control model that
provides users with a certain amount of control over their data. Data owners
(document creators or any users authorized to control data) can define access
permissions for specific users or groups of users.

In other words, whom to give access to and what privileges to grant are
decided at the resource owner’s discretion.

Access permissions for each piece of data are stored in an access control list
(ACL). An administrator creates this list when a user grants access to somebody.
The list can be generated automatically.

An ACL includes users and groups that may access data and the levels of access
they have. A system administrator can also enforce an ACL. In this case, the ACL
acts as a security policy, and regular users can’t edit or overrule it.
BASIC PRINCIPLES OF DAC
Object characteristics (size, name, directory path) are invisible to users that
aren’t authorized.

Several failed access attempts enforce additional multi-factor authentication

or deny access.

Users can transfer their object ownership to other users. Also, the owner
determines the access type of other users. Based on these access privileges, the
operating system decides whether to grant access to a file.
HOW IT WORKS?
User 1 creates a file and becomes its owner, or obtains
access rights to an existing file.

User 2 requests access to this file. They provide their

credentials: username, password, or something else.

User 1 grants access at their discretion. However, user 1

can’t grant access rights that exceed their own. For
example, if user 1 can only read a document, they can’t
allow user 2 to edit it.

If there’s no contradiction between the ACL created by

an administrator and the decision made by user 1, access
is granted.
EXAMPLE
Let's consider a scenario in which a user named Alice owns a file on a Unix-based system, and
she wants to control who can read, write, and execute that file.

1. Ownership: Alice owns the file, which means she has full control over it.
2. Permissions: She can set permissions for herself (the owner), the group she belongs to, and
others (everyone else).

For herself: Alice grants read and write permissions, allowing her to view and modify the file.
For the group: Alice belongs to a group called "Project Team." She decides to grant read-only
access to the file for all members of the Project Team.
For others: She decides to deny any access to the file for all other users.

Alice can now control who can access her file and what actions they can perform on it.
If Alice later decides to change the permissions, she can do so at any time.
With DAC, Alice has discretion over who can access her file and what they can do with it,
without needing approval from a central authority.
PROS OF DAC
User-friendly: Users can manage their data and quickly access data of other
users.

Flexible: Users can configure data access parameters without administrators.

Easy to maintain: Adding new objects and users doesn’t take much time for the
administrator.

Granular: Users can configure access parameters for each piece of data.
CONS OF DAC
Low level of data protection: DAC can’t ensure reliable security because users
can share their data however they like.

Obscure access management: There’s no centralized access management, so in

order to find out access parameters, you have to check each ACL.

Overlay of user privileges: A permissions conflict may happen with users of

multiple nested workgroups.
THANKYOU