Video summary

Explain Access Control Models| Discretionary DAC, Mandatory MAC, RBAC, Rule, Attribute, Risk based

Main summary

Key takeaways

Technology

Access Control (core concept)

  • Access control is a security mechanism that determines who can access a resource and what actions they are allowed to perform.
  • It is typically implemented using authentication + authorization:
    • Authentication verifies who you are (e.g., login with user ID + password).
    • Authorization checks which resources/actions your account is permitted to use and grants permissions accordingly.

Access Control Models

1) DAC — Discretionary Access Control (identity/owner-driven)

  • Decision maker: the resource owner/creator (data custodian).
  • The owner assigns permissions (e.g., user1 read-only, user2 read/write).
  • Implemented via ACLs (Access Control Lists):
    • ACL = list of permissions tied to a resource indicating which users/processes/applications can access it.

Characteristics

  • Decentralized: owners can change ACLs.
  • Identity-based: permissions depend on identity/role of the owner’s assigned subjects.

Pros

  • Flexible, fine-grained, simple to implement, relatively low cost.

Cons

  • Security risks from poor owner decisions.
  • Lack of centralized control.
  • Hard to manage consistency at scale.

2) Non-DAC — Non-discretionary access control (centrally managed)

  • Decision maker: a central authority using predefined policies/rules.

Pros

  • More secure than DAC.
  • Consistent enforcement.
  • Easier management and more scalable for organizations.

Cons

  • Less flexible.
  • Can be complex due to centralized policy management.

Non-DAC subtypes covered

  • RBAC — Role-Based Access Control

    • Access depends on the user’s job role.
    • Permissions are attached to roles/groups, and users inherit permissions via group membership.
    • Example: hospital roles (doctors can view/edit medical records; nurses can view only; admins can view financial info only).
    • Enforces least privilege and reduces privilege creep (excess permissions from past role changes).

  • TBAC — Task-Based Access Control

    • Similar to RBAC, but access is based on tasks rather than roles.

  • Rule-Based Access Control

    • Uses predefined global rules applying to all subjects.
    • Example analogy: a firewall allowing/blocking traffic based on rules (protocols, ports, IPs).

  • ABAC — Attribute-Based Access Control

    • A more advanced, fine-grained form of rule-based control using attributes such as:
      • location
      • device type
      • education level
      • time/work schedule
    • Example: allow access only for users in a specific location; SDNs may use ABAC for laptop/company-device-only access.

  • MAC — Mandatory Access Control (label/classification controlled; “lattice”)

    • Used in high-security environments (government/military).
    • Users and objects have labels representing clearance/sensitivity (e.g., Top Secret / Secret / Confidential).
    • Two variants:
      • Hierarchical model: higher clearance can access its level and lower levels, but not higher.
      • Compartmentalized model: need-to-know is enforced; separate compartments/isolation with no direct relationship.
    • Also mentioned: a hybrid model combining hierarchical + compartmentalized ideas.

  • Risk-Based Access Control (RbiAC)

    • Evaluates login/access attempts using real-time context and risk factors.
    • Factors include:
      • Device familiarity/history
      • Location (home/office/used before)
      • Network/IP reputation (familiar vs new)
      • Sensitivity/importance of the resource
    • Outcome:
      • Either allow normal login, or require step-up authentication (e.g., MFA/OTP and device registration via a company portal).

Interview/usage takeaway

  • The guidance is to be able to explain the main models (DAC vs Non-DAC) and the major subtypes (MAC, RBAC, ABAC, rule-based, TBAC, risk-based), including what drives decisions:
    • owner (DAC)
    • central authority (Non-DAC)
    • roles/tasks/attributes/labels/risk context

Main speakers / sources

  • Main source/speaker: “cyber platter” (the channel/host mentioned at the start: “welcome to cyber platter”).
  • External citations/sources: none referenced in the subtitles.

Original video