IAM - Access Control Models

Access Control Methods

When it comes to our access control, we can actually take quite a few different approaches in how we implement permissions and access control. Let's cover what those different methods are, so that way you can make an educated decision on what you need to implement in the networks that you work with.

There's a lot of different access control methods, so we'll talk about the different ones and define what discretionary is, mandatory, role-based, rule-based, attribute and risk-based, and different access control lists. One thing to note is that there are other ones out there that we aren't covering. There's graph-based, history-based, history of presence-based, identity, lattice, organization, and responsibility-based. So there's different ones that we can actually have out there, but the lines get a little blurred between these. That is, there's not a clear definition sometimes between these, and we're going to cover the most prevalent ones that you're going to see out there.

One thing to note is that it's not like a company's just going to choose one and that's the only method that they're going to use. An example of this is a rule-based access control method is a very common one that companies will choose to implement organizational-wide. However, even though they've chosen to implement that organizational-wide, there may be times, like the firewall, where they're doing a rule-based access control method, or perhaps they're doing discretionary on certain resources. So there are times when we're going to actually mix this up, even if the company overall has chosen one of these as being the primary way of access control.

Discretionary Access Control

The first example is discretionary access control, and the key term here is discretionary. It's at the discretion of the people to be able to manage, or the users to be able to manage, their own access.

So a good example is maybe it has set up a finance share, and the finance department has access into this finance share. So anybody that's part of the finance team gets access to this share, but they have full rights into this share, which means one thing they can change is permissions. So it's at their discretion to be able to allow other people into this folder as well. And so now they are able to, when they need to share out certain reports, maybe with the CEO or with maybe the sales team, maybe they within this folder or the folder altogether change the permissions to share it out to the salespeople, so now they have access to those reports.

Mandatory Access Control

That's different than mandatory access control. Mandatory access control is now the opposite side of the spectrum, where you don't allow people to have discretionary control over it.

So our example here is the finance team does have access into this folder, but they don't have full permissions. They just have access to create within it, to read other people's documents, but not to change permissions. So now if somebody wants to gain access to this, they need to go and get permission from somebody like IT, or maybe it's the lead of the finance team. There's somebody specific who's in charge of this resource right here, and they have to get permission from that person who's in charge of it. So that's mandatory, and it's mandatory that they get permission, and it's not discretionary; they have to go through somebody else to be able to get access to this folder.

Role-Based Access Control

Then there's role-based access control, and the idea behind role-based access control is that we assign a role to a user, and then that role is assigned to different resources.

So let's use an example of cicu here is the CEO of a company, and so he is given access to certain resources, maybe it's business ideas, maybe it's finance, customers, partners. So this role has access to the resources, and suu doesn't have direct access to those. And same thing, Sonia has access to all the resources that accounting has access to. Neil has all access to the data entry. Maybe Sonia and Neil are both part of the ERC. So this is set up so that people have access to roles, or are part of roles, and then the roles have access to different folders and different resources.

Now one reason why you set it up this way is, let's say we were to set up Sonia directly on certain folders here, and then Sonia switches positions within the company. She's now in a different position and doesn't need access to finance. Now the problem is that if this were to be implemented on individual folders rather than a group, then you have to go and change the permissions on every single resource that Sonia has access to, something that's probably going to get missed, certain resources that are out there. So if we assign her to a role first and then that to the different resources, as soon as she changes roles then we can remove her from the accountant role, and now immediately she does not have access to things like finance. And when somebody comes in to replace her, we give that replacement access to the accountant role, and now that replacement has access to everything that they need access to.

So role-based is actually one of the most common promoted ones that are out there, and one that if you, for things like cybersecurity, you're going to be asked, do you have role-based access control methods in place?

Rule-Based Access Control

Then there is a rule-based access control, and a good example of this is on a firewall. So let's say we have a user out here who has never been on our system and is trying to access our website, and we want a website behind the firewall, because we don't want to just allow anybody to gain access to all of the server. We want them to get access to our web server. We want everybody to be able to come and visit our web page, that's something we want to encourage, but the rest of the server needs to be locked down. We don't want them to gain access to other parts of that server.

And so what we need to do is we need to allow this user to get there. Well, with something like role-based or discretionary or mandatory, we can't give access to every single user that's out there in an efficient manner, it just isn't going to work. So we have to open up a specific hole for this web server so people can get into this web server wherever they're coming from. What we do is we set up a rule base that allows traffic from all sorts of IP addresses into specifically a port that this web server is on, and only that port and nothing else on this server.

Attribute-Based and Risk-Based

Then we have attribute based. A rule base is where we base their access off of a role that they have. Attribute based is actually very similar to it, but perhaps it's some sort of other attribute rather than just rule. Maybe it's the department that they work in, or maybe it's the location, whether they're part of the headquarters or maybe some sort of branch office. Maybe it's who they are reporting to, who their manager is. Perhaps it's the shift that they work. So some sort of attribute that they have that gives them access to certain resources.

Then we have risk based, and risk-based is when you base your decisions on access control based off of risk. And a good example of this might be that maybe we test people's passwords to make sure that they have secure passwords, and if they don't have a password secure enough, we're not going to give them access to certain parts of our resources. So maybe Neil here has a really weak password, and so we cut off access to certain resources until he is able to create a better password. So that's risk based, is you're making your decisions on access control based off of risk.

Mixing Methods in Practice

So there's a lot of options that are out there, and like I say, it's going to be pretty common for you to use multiple. The companies that I worked for in the past have really been a rule-based access control method, but on our firewalls we always did rule-based access control method. And then there are certain resources that were shared out to everybody, but people could go there and adjust the permissions to only share with certain people, so it was some sort of discretionary access control. There was some element of mandatory access control where you had to come through the IT department to get permissions to certain resources as well. So I've used a combination of all of these really to roll out the networks that I've worked with, but the primary that really I've used is the rule-based access control.