1 of 4

Access Control

Types of Access Control

​

Adam Doupé

Arizona State University

​

https://pwn.college

2 of 4

Other Access Control Ideas

  • Content dependent controls
    • You can only see salaries less than 50K
    • You can only see salaries of employees who report to you
  • Context dependent controls
    • Cannot access sensitive information from a remote login
    • Salary information can be updated only at year end
    • Company’s earnings report is confidential until announced at the stockholder’s meeting

2

3 of 4

Types of Access Control

  • Discretionary Access Control
    • Owner of the object controls who can access the object
  • Mandatory Access Control
    • System controls access to an object
  • Originator Controlled Access Control
    • Originator of the object controls who can access the object

3

4 of 4

Other Types of Access Control

  • Role Based Access Control (RBAC)
    • User’s permissions are determined by the user’s role
      • Rather than identity (DAC) or clearance (MAC)
    • More natural expression of business logic
  • Attribute Based Access Control (ABAC)
    • Users have attributes (age, ID number, group membership, etc.)
    • Policy is a complex Boolean expression on the attributes

4