Fundamental Access Control Methods

Why This Matters

Access control is the backbone of every security architecture you'll encounter in cybersecurity business contexts. When you're being tested on this material, examiners aren't just checking whether you can define DAC or RBAC—they want to see that you understand why organizations choose one method over another, how these methods balance security with usability, and what happens when access controls fail or are poorly implemented. These concepts connect directly to risk management, compliance frameworks, and the principle of defense in depth.

The methods covered here demonstrate core security principles: least privilege, separation of duties, defense in depth, and the constant tension between security and convenience. Don't just memorize what each acronym stands for—know what business problem each method solves, which environments favor which approaches, and how they can be combined. That's what separates a passing answer from an excellent one.

---

Permission Assignment Models

These methods define who decides what access users receive. The fundamental question: should resource owners, central authorities, or organizational structure determine permissions?

Discretionary Access Control (DAC)

• Resource owners control access—the creator or owner of a file decides who else can read, write, or execute it
• Users can transfer permissions to others, creating flexibility but introducing permission sprawl and potential security gaps
• Common in personal computing and small business environments where formal security hierarchies aren't practical

Mandatory Access Control (MAC)

• Central authority sets fixed policies—individual users cannot override or modify access decisions regardless of ownership
• Classification labels (like Top Secret, Confidential, Unclassified) determine access based on user clearance levels
• Required in government and military contexts where data sensitivity demands strict, non-negotiable controls

Role-Based Access Control (RBAC)

• Permissions attach to roles, not individuals—a "Sales Manager" role carries specific access rights that any user in that role inherits
• Simplifies administration dramatically in large organizations by grouping users with similar job functions
• Enforces least privilege by design, since roles are typically scoped to job requirements

---

Context-Aware and Dynamic Controls

These methods go beyond static permission lists, evaluating conditions and attributes at the moment of access. They answer the question: what factors beyond identity should influence access decisions?

Rule-Based Access Control

• Conditional logic governs access—rules like "allow access only during business hours" or "block requests from foreign IP addresses"
• Commonly implemented in firewalls and network security appliances where traffic must be evaluated against defined criteria
• Operates independently of user identity, making it complementary to other access control methods

Attribute-Based Access Control (ABAC)

• Multiple attributes evaluated simultaneously—user department, resource sensitivity, time of day, device type, and location can all factor into one decision
• Supports complex, fine-grained policies that adapt to context without requiring new roles or rules for every scenario
• Ideal for cloud and distributed environments where traditional perimeter-based controls don't apply

---

Identity Verification Methods

Before any access control model can work, systems must confirm you are who you claim to be. These methods address authentication—the critical first step.

Identity-Based Access Control (IBAC)

• Unique identifiers verify users—usernames, employee IDs, or digital certificates establish identity before access evaluation
• Foundation for all other methods, since DAC, MAC, RBAC, and ABAC all require confirmed identity to function
• Often combined with other controls to create layered security (identity confirms who you are, roles determine what you can do)

Multi-Factor Authentication (MFA)

• Requires two or more verification factors—combining something you know (password), something you have (token/phone), and something you are (biometric)
• Dramatically reduces credential theft risk because compromising one factor doesn't grant access
• Industry standard for sensitive systems and increasingly required by compliance frameworks like PCI-DSS and HIPAA

Single Sign-On (SSO)

• One authentication grants access to multiple applications—users log in once and move between systems without re-authenticating
• Reduces password fatigue and the security risks of users reusing or writing down multiple passwords
• Centralizes authentication but creates a single point of failure—if SSO is compromised, all connected applications are exposed

---

Security Design Principles

These aren't access control methods per se—they're foundational principles that guide how any access control system should be designed and maintained.

Least Privilege Principle

• Minimum necessary access only—users receive exactly the permissions required for their job functions, nothing more
• Limits blast radius of compromised accounts by ensuring attackers can't leverage excessive permissions
• Requires ongoing review as roles change; stale permissions accumulate when employees transfer or take on new responsibilities

Separation of Duties

• No single person controls entire processes—critical operations require multiple individuals, creating built-in checks and balances
• Prevents fraud and reduces errors by ensuring one person can't initiate, approve, and execute sensitive transactions alone
• Compliance requirement in financial services (SOX), healthcare (HIPAA), and payment processing (PCI-DSS)

---

Quick Reference Table

---

Self-Check Questions

1. Which two access control methods both rely on predefined organizational structure, but differ in whether users or administrators assign permissions? What makes each appropriate for different environments?

2. A healthcare organization needs to restrict access to patient records based on the requesting user's department, the patient's care team assignment, and whether the request originates from inside the hospital network. Which access control method best fits this requirement, and why?

3. Compare and contrast MFA and SSO in terms of their impact on security posture and user experience. How might an organization implement both without creating conflicting effects?

4. An FRQ asks you to design access controls for a financial system that processes wire transfers. Which two security principles from this guide are most critical, and how would you implement them?

5. Why would a government agency handling classified documents choose MAC over RBAC, even though RBAC is generally easier to administer? What specific security requirement does MAC address that RBAC cannot?