Access Control Models

When it comes to our access control, we can actually take quite a few different approaches in how we implement permissions and access control. There are a lot of different access control methods, so we'll talk about the different ones and define what discretionary, mandatory, role-based, rule-based, attribute and risk-based access control lists are.

One thing to note is that there are other ones out there that we aren't covering: graph-based, history-based, history of presence based, identity, lattice, organization, and responsibility-based. So there are different ones that we can actually have out there, but the lines get a little blurred between these — that is, there's not a clear definition sometimes between these — and we're going to cover the most prevalent ones that you're going to see out there.

Another thing to note is that it's not like a company is just going to choose one and that's the only method that they're going to use. An example of this is that a role-based access control method is a very common one that companies will choose to implement organization-wide. However, even though they've chosen to implement that organization-wide, there may be times, like the firewall, where they're doing a rule-based access control method, or perhaps they're doing discretionary on certain resources. So there are times when we are going to actually mix this up, even if the company overall has chosen one of these as being the primary way of access control.

Discretionary Access Control

The first example is discretionary access control, and the key term here is discretionary: it's at the discretion of the users to be able to manage their own access.

A good example is maybe IT has set up a finance share, and the finance department has access into this finance share. Anybody that's part of the finance team gets access to the share, but they have full rights into this share, which means one thing they can change is permissions. So it's at their discretion to be able to allow other people into this folder as well. Now they are able to, when they need to share out certain reports maybe with the CEO or maybe with the sales team, change the permissions on this folder, or the folder altogether, to share it out to the salespeople, so now they have access to those reports.

Mandatory Access Control

That's different than mandatory access control. Mandatory access control is the opposite side of the spectrum, where you don't allow people to have discretionary control over it.

In our example here, the finance team does have access into this folder, but they don't have full permissions. They just have access to create within it, to read other people's documents, but not to change permissions. So now if somebody wants to gain access to this, they need to go and get permission from somebody like IT, or maybe it's the lead of the finance team. There's somebody specific who's in charge of this resource right here, and they have to get permission from that person who's in charge of it. So that's mandatory: it's mandatory that they get permission, and it's not discretionary — they have to go through somebody else to be able to get access to this folder.

Role-Based Access Control

Then there's role-based access control. The idea behind role-based access control is that we assign a role to a user, and then that role is assigned to different resources.

Let's use an example. cicu here is the CEO of a company, and so he is given access to certain resources: maybe it's business ideas, maybe it's finance, customers, partners. So this role has access to the resources, and suu doesn't have direct access to those. Same thing with Sonia: she has access to all the resources that accounting has access to, and Neil has all the access to the data entry. Maybe Sonia and Neil are both part of the ERC. So this is set up so that people have access to roles, or are part of roles, and then the roles have access to different folders and different resources.

One reason why you set it up this way is this. Let's say we were to set up Sonia directly on certain folders here, and then Sonia switches positions within the company — she's now in a different position and doesn't need access to finance. If this were to be implemented on individual folders rather than a group, then you have to go and change the permissions on every single resource that Sonia has access to, which is something that's probably going to get missed, with certain resources left out there. So if we assign her to a role first, and then that role to the different resources, as soon as she changes roles we can remove her from the accountant role, and now immediately she does not have access to things like finance. When somebody comes in to replace her, we give that replacement access to the accountant role, and now that replacement has access to everything that they need access to.

rbase is actually one of the most commonly promoted ones that are out there, and one that, for things like cyber security, you're going to be asked: do you have role-based access control methods in place?

Rule-Based Access Control

Then there is rule-based access control, and a good example of this is on a firewall. Let's say we have a user out here who has never been on our system and is trying to access our website. We want a website behind the firewall, because we don't want to just allow anybody to gain access to all of the server. We want them to get access to our web server — we want everybody to be able to come and visit our web page, that's something we want to encourage — but the rest of the server needs to be locked down. We don't want them to gain access to other parts of that server.

So what we need to do is allow this user to get there. With something like role-based or discretionary or mandatory, we can't give access to every single user that's out there in an efficient manner; it just isn't going to work. So we have to open up a specific hole for this server, for this web server, so people can get into this web server wherever they're coming from. What we do is we set up a rule base that allows traffic from all sorts of IP addresses into specifically the port that this web server is on, and only that port and nothing else on this server.

Attribute-Based Access Control

Then we have attribute-based. Role-based is where we base their access off of a role that they have. Attribute-based is actually very similar to it, but perhaps it's some sort of other attribute rather than just role. Maybe it's the department that they work in, or maybe it's the location — whether they're part of the headquarters or maybe some sort of branch office. Maybe it's who they are reporting to, who their manager is. Perhaps it's the shift that they work. So it's some sort of attribute that they have that gives them access to certain resources.

Risk-Based Access Control

Then we have risk-based. Risk-based is when you base your decisions on access control off of risk. A good example of this might be that maybe we test people's passwords to make sure that they have secure passwords, and if they don't have passwords secure enough, we're not going to give them access to certain parts of our resources. So maybe Neil here has a really weak password, and so we cut off access to certain resources until he is able to create a better password. That's risk-based: you're making your decisions on access control based off of risk.

Mixing the Models

There are a lot of options that are out there, and like I say, it's going to be pretty common for you to use multiple. The companies that I have worked for in the past have really been a role-based access control method, but on our firewalls we always did a rule-based access control method. Then there are certain resources that were shared out to everybody, but people could go there and adjust the permissions to only share with certain people, so that was some sort of discretionary access control. There was some element of mandatory access control, where you had to come through the IT department to get permissions to certain resources as well. So I've used a combination of all of these really, to roll out the networks that I've worked with, but the primary that I've used is role-based access control.