Do you know the various access control models? You should if you’re planning to take the Security+ exam. This post should help.
Here’s a sample practice test question:
Q. An organization has implemented an access control model that enforces permissions based on data labels assigned at different levels. What type of model is this?
A. DAC
B. MAC
C. Role-BAC
D. Rule-BAC
Can you answer the question? More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Mandatory Access Control
The MAC model uses labels (sometimes referred to as sensitivity labels or security labels) to determine access. Security administrators assign labels to both subjects (users) and objects (files or folders). When the labels match, the system can grant a subject access to an object. When the labels don’t match, the access model blocks access.
Military units make wide use of this model to protect data. You may have seen movies where they show a folder with a big red and black cover page labeled “Top Secret.” The cover page identifies the sensitivity label for the data contained within the folder. Users with a Top Secret label (a Top Secret clearance) and a need to know can access the data within the Top Secret folder.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Need to know is an important concept to understand. Just because individuals have a Top Secret clearance, it doesn’t mean they should automatically have access to all Top Secret data. Instead, access is restricted based on a need to know. Need to know is similar in concept to the principle of least privilege, but it only applies to data and data permissions. In contrast, the principle of least privilege applies to permissions and rights.
Security-enhanced Linux (SELinux) is one of the few operating systems using the mandatory access control model. SELinux was specifically created to demonstrate how mandatory access controls can be added to an operating system. In contrast, Windows operating systems use the discretionary access control model.
Discretionary Access Control
In the DAC model, every object (such as files and folders) has an owner, and the owner establishes access for the objects. Many operating systems, such as Windows and most Unix-based systems, use the DAC model.
A common example of the DAC model is the NT File System (NTFS) used in Windows. NTFS provides security by allowing users and administrators to restrict access to files and folders with permissions. NTFS is based on the DAC model and the following section explains how it uses the DAC model.
SIDs and DACLs
Microsoft systems identify users with security identifiers (SIDs), though you will rarely see a SID. A SID is a long string of characters that is meaningless to most people and may look like this:
S-1-5-21-3991871189-223218. Instead of the system displaying the SID, it looks up the name associated with the SID and displays the name. Similarly, Microsoft systems identify groups with a SID.
Every object (such as a file or folder) includes a discretionary access control list (DACL) that identifies who can access it in a system using the DAC model. The DACL is a list of Access Control Entries (ACEs). Each ACE is composed of a SID and the permission(s) granted to the SID. As an example, a folder named Study Notes might have the following permissions assigned:
- Lisa Full Control
- Bart Read
- Maggie Modify
Each of these entries is an ACE and combined they are a DACL.
The Owner Establishes Access
If users create a file, they are designated as the owner and have explicit control over the file. As the owner, users can modify the permissions on the object by adding user or group accounts to the DACL and assigning the desired permissions.
The DAC model is significantly more flexible than the MAC model described in the next section. MAC has predefined access privileges, and the administrator is required to make the changes. With DAC, if you want to grant another user access to a file you own, you simply make the change, and that user has access.
Remember this
The DAC model specifies that every object has an owner, and the owner has full, explicit control of the object. Microsoft NTFS uses the DAC model.
Q. An organization has implemented an access control model that enforces permissions based on data labels assigned at different levels. What type of model is this?
A. DAC
B. MAC
C. Role-BAC
D. Rule-BAC
Answer is B. The mandatory access control (MAC) model uses labels assigned at different levels to restrict access.
The discretionary access control (DAC) model assigns permissions based on object ownership.
The role-based access control (role-BAC) model uses group-based privileges.
The rule-based access control (rule-BAC) model uses rules that trigger in response to events.
