Access controls ensure that only authenticated and authorized entities can access resources. If you’re planning to take the SY0-401 or SY0-501 exam, you should have a basic understanding of how different access control models handle authentication and authorization.
For example, can you answer this question?
Q. An administrator needs to grant users access to different servers based on their job functions. Which access control model is the BEST choice to use?
A. Discretionary access control
B. Mandatory access control
C. Role-based access control
D. Rule-based access control
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Access Control Models
Access control ensures that only authenticated and authorized entities can access resources. For example, it ensures that only authenticated users who have been granted appropriate permissions can access files on a server. Access control is dependent on accurately identifying users and authenticating them. However, once users have been identified and authenticated, it’s possible to grant them access using one of several different models.
You’re probably familiar with some of these topics, but the terms role-BAC, rule-BAC, DAC, and MAC may be unfamiliar. By understanding a little more of the underlying design principles, you’ll understand why some of the rules are important, and you’ll be better prepared to ensure that security principles are followed.
You may notice that CompTIA uses the acronym RBAC for both rule-based access control and role-based access control. For clarity, this blog uses role-BAC or rule-BAC instead of the ambiguous RBAC.
Often, when using any of the models, you’ll run across the following terms:
- Subjects. Subjects are typically users or groups that access an object. Occasionally, the subject may be a service that is using a service account to access an object.
- Objects. Objects are items such as files, folders, shares, and printers that subjects access. For example, users access files and printers. The access control model (role-BAC, rule-BAC, DAC, or MAC) helps determine how a system grants subjects authorization to objects. Or, said another way, the access control model determines how a system grants users access to files and other resources.
Role-Based Access Control
Role-based access control uses roles to manage rights and permissions for users. This is useful for users within a specific department who perform the same job functions. An administrator creates the roles and then assigns specific rights and permissions to the roles (instead of to the users). When an administrator adds a user to a role, the user has all the rights and permissions of that role.
Using Roles Based on Jobs and Functions
Imagine your organization has several departments such as Accounting, Sales, and IT, and each department has a separate server hosting its files. You can create roles of Accounting, Sales, and IT and assign these roles to users based on the department where they work. Next, you’d grant these roles access to the appropriate server. For example, you’d grant the Accounting role to the Accounting server, grant the Sales role to the Sales server, and so on.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Documenting Roles with a Matrix
Think about the developers of Microsoft Project Server. They didn’t just start creating roles. Instead, they did some planning and identified the roles they envisioned in the application. Next, they identified the privileges each of these roles required. It’s common to document role-based permissions with a matrix listing all of the job titles and the privileges for each role, as shown below.
Role-BAC matrix for Project Server
Role-BAC is also called hierarchy-based or job-based:
- Hierarchy-based. In the Project Server example, you can see how top-level roles, such as the Administrators role, have significantly more permissions than lower-level roles, such as the Team Members role. Roles may mimic the hierarchy of an organization.
- Job-, task-, or function-based. The Project Server example also shows how the roles are centered on jobs or functions that users need to perform.
Remember this
A role-BAC model uses roles based on jobs and functions. A matrix is a planning document that matches the roles with the required privileges.
Q. An administrator needs to grant users access to different servers based on their job functions. Which access control model is the BEST choice to use?
A. Discretionary access control
B. Mandatory access control
C. Role-based access control
D. Rule-based access control
Answer is C. The role-based access control model is the best choice for assigning access based on job functions.
A discretionary access control model specifies that every object has an owner and owners have full control over objects, but it isn’t related to job functions.
Mandatory access control uses labels and a lattice to grant access rather than job functions.
A rule-based access control model uses rules that trigger in response to events.
For more information on access control models, see Chapter 4 of the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide
or
Chapter 5 of the CompTIA Security+ Get Certified Get Ahead: SY0-501 Study Guide.
