Access Control Models – in Cybersecurity

What You’ll Learn 📚

• Understand the core concepts of access control models
• Learn key terminology with friendly definitions
• Explore simple to complex examples
• Get answers to common questions
• Troubleshoot common issues

Introduction to Access Control Models

Access control models are essential in cybersecurity as they determine how resources are accessed and who can access them. Think of them as the rules that govern who gets the keys to the kingdom! 🏰

Core Concepts

Let’s break down the core concepts:

• Access Control: The process of granting or denying specific requests to obtain and use information and related information processing services.
• Subjects: The users or entities that request access to resources.
• Objects: The resources or data that need protection.
• Permissions: The rights granted to subjects to perform operations on objects.

Key Terminology

• Discretionary Access Control (DAC): Access is based on the identity of the requestor and access rules that specify who can access what.
• Mandatory Access Control (MAC): Access is based on fixed policies determined by a central authority.
• Role-Based Access Control (RBAC): Access is based on the roles assigned to users within an organization.

Simple Example: Discretionary Access Control (DAC)

Example Code in Python

# Simple DAC example
class Resource:
    def __init__(self, name):
        self.name = name
        self.permissions = {}

    def set_permission(self, user, permission):
        self.permissions[user] = permission

    def check_permission(self, user):
        return self.permissions.get(user, 'No Access')

# Create a resource
book = Resource('Python Programming')

# Set permissions
book.set_permission('Alice', 'Read')
book.set_permission('Bob', 'Write')

# Check permissions
print(f"Alice's permission: {book.check_permission('Alice')}")  # Output: Read
print(f"Bob's permission: {book.check_permission('Bob')}")    # Output: Write
print(f"Eve's permission: {book.check_permission('Eve')}")    # Output: No Access

Progressively Complex Examples

Example 1: Mandatory Access Control (MAC)

# Simple MAC example
class SecurityLevel:
    def __init__(self, level):
        self.level = level

class User:
    def __init__(self, name, clearance):
        self.name = name
        self.clearance = clearance

class Document:
    def __init__(self, title, security_level):
        self.title = title
        self.security_level = security_level

    def can_access(self, user):
        return user.clearance.level >= self.security_level.level

# Create security levels
confidential = SecurityLevel(1)
secret = SecurityLevel(2)

# Create users
alice = User('Alice', secret)
bob = User('Bob', confidential)

# Create documents
report = Document('Annual Report', confidential)
secret_plan = Document('Secret Plan', secret)

# Check access
print(f"Alice can access report: {report.can_access(alice)}")  # Output: True
print(f"Bob can access secret plan: {secret_plan.can_access(bob)}")  # Output: False

Example 2: Role-Based Access Control (RBAC)

# Simple RBAC example
class Role:
    def __init__(self, name):
        self.name = name
        self.permissions = set()

    def add_permission(self, permission):
        self.permissions.add(permission)

class User:
    def __init__(self, name, role):
        self.name = name
        self.role = role

    def has_permission(self, permission):
        return permission in self.role.permissions

# Create roles
manager = Role('Manager')
manager.add_permission('approve_budget')

engineer = Role('Engineer')
engineer.add_permission('commit_code')

# Create users
alice = User('Alice', manager)
bob = User('Bob', engineer)

# Check permissions
print(f"Alice can approve budget: {alice.has_permission('approve_budget')}")  # Output: True
print(f"Bob can commit code: {bob.has_permission('commit_code')}")  # Output: True
print(f"Alice can commit code: {alice.has_permission('commit_code')}")  # Output: False

Common Questions and Answers

1. What is the main difference between DAC and MAC?

   DAC is based on the discretion of the resource owner, while MAC is based on strict policies set by a central authority.

2. Why is RBAC considered more flexible?

   RBAC allows for easy management of permissions by assigning roles to users, making it scalable and adaptable to organizational changes.

3. Can a system use more than one access control model?

   Yes, many systems combine models to leverage the strengths of each.

4. How do access control models enhance security?

   They ensure that only authorized users can access specific resources, reducing the risk of unauthorized access.

5. What are common pitfalls when implementing access control?

   Common issues include overly permissive settings, lack of regular audits, and not updating permissions as roles change.

Troubleshooting Common Issues

Ensure that permissions are regularly reviewed and updated to reflect changes in roles or policies.

Regular audits of access control settings can help identify and rectify potential security gaps.

Practice Exercises

• Create a simple DAC system where users can share files with specific permissions.
• Implement a MAC system where documents have different classification levels and users have corresponding clearance levels.
• Design an RBAC system where users can be assigned multiple roles and permissions are cumulative.

For further reading, check out the NIST Glossary for more detailed definitions and explanations.