Choosing an Access-Control Model

AP Cybersecurity · Securing Applications and Data

Choosing an Access Control Model

Subjects, operations, objects — the model is just who gets to decide.

key ideaAccess control is subjects, operations, objects. The model is just who gets to decide.

The criteria

Access control enforces which users or applications — subjects — can access, modify, add or remove — operations — which files or applications — objects. The four models describe different ways of deciding, and they suit different organizations.

Model	Who decides	How it works	Suits
RBAC	the organization, by role	every subject is assigned a role; roles define which access applies to which objects	organizations with clear job functions
RuBAC	a rule set	a set of rules is checked to decide what access a subject has to a specific object	conditions beyond identity — time, location, device
DAC	the owner of the object	subjects set the access other subjects have on objects they own; some subjects are administrators	collaborative environments; small teams
MAC	the system, by level	strict rules for access to objects above, at, or below the subject's level	government and military — Bell-LaPadula

Read the second column. The models differ in where the authority to grant access sits — with an owner, a role definition, a rule set, or a classification level.

SubjectA user or application that acts on something.

OperationWhat is done — access, modify, add, remove.

ObjectThe file or application being acted on.

Bell-LaPadulaA MAC model used by governments and military organizations, with no read up and no write down as its two properties.

Least privilegeEntities are given exactly as much access as they need to perform their function and no more.

Comparing the options

Reading down, authority moves further from the individual and closer to the institution. DAC trusts the owner; MAC trusts nobody but the classification.

FIRST

Are there clear, stable job functions?RBAC assigns every subject to a role and defines which roles have which access to which objects. It is the usual answer for an organization where 'what someone does' predicts 'what they should reach'.

CONDITIONS

Does access depend on more than identity?If time of day, location or device should change the answer, RuBAC fits — it checks a set of rules to determine the access a subject should have for a specific object, then allows or denies accordingly.

OWNERSHIP

Do the people creating content know best who should see it?DAC lets individual subjects set the access other subjects have on objects they own, with some subjects designated as administrators. Flexible — and inconsistent, because every owner decides separately.

CLASSIFICATION

Is the data formally classified by level?MAC follows strict rules for what each subject level may do with objects above, at, or below their level. This is the government and military model, and Bell-LaPadula is its canonical form.

ALWAYS

Whichever model you choose —apply the principle of least privilege: entities get exactly as much access as they need to perform their function, and no more. The model decides who grants; least privilege decides how much.

Worked analysis

EX 1

Choose for a hospital

Clinicians, administrators and cleaners all need different access. Staff change roles regularly. Which model?

Note what predicts access

The job function — a nurse needs what nurses need.

Choose the model

RBAC — assign every subject to a role, and define the access each role has.

Note the operational benefit

When someone changes job, you change their role rather than auditing individual permissions.

Reject DAC here

Owner-decided access across thousands of records would be inconsistent and unauditable.

Apply least privilege within the model

Each role gets exactly what its function requires — RBAC does not excuse over-broad roles.

EX 2

When identity is not enough

A finance system should permit transfers only from office devices during working hours, even for authorized staff. Which model?

Test RBAC

Roles answer who the subject is — but the requirement is about when and from where.

Name the model that fits

RuBAC — a set of rules is checked to decide the access for a specific object.

Write the rules

Permit transfer if role is finance and device is managed and time is within hours.

Note that the models combine

In practice RBAC supplies the role and RuBAC adds the conditions.

State the gain

A compromised credential used at 03:00 from an unknown device fails the rule even though the role is correct.

EX 3

Bell-LaPadula in practice

Explain the two properties of Bell-LaPadula and what each prevents.

State the model type

A MAC model, used by governments and military organizations to control the security of information.

State the first property

No read up — a subject cannot read objects above their level.

State the second

No write down — a subject cannot write to objects below their level.

Say what each prevents

The first stops unauthorized disclosure upward; the second stops a cleared subject leaking classified content into a lower level.

Note why it is strict

The system decides, not the owner — which is the point when the classification is set by law rather than by preference.

Check yourself

Define the three components of access control.

Show answer

Subjects — users or applications; operations — access, modify, add or remove; and objects — the files or applications acted on.

Distinguish RBAC from RuBAC.

Show answer

RBAC assigns every subject to a role and defines which roles have which access. RuBAC checks a set of rules to determine what access a subject should have for a specific object, then allows or denies.

What characterizes DAC, and what is its weakness?

Show answer

Individual subjects set the access other subjects have on objects they own, with some designated as administrators. Its weakness is inconsistency — every owner decides separately.

State the principle of least privilege.

Show answer

Entities should be given exactly as much access as they need to perform their function, and no more — a principle that applies whichever model is chosen.

Course map. Topic 5.2.c · LO 5.2.C — determine an appropriate access control model to protect applications and data (EK 5.2.C.1–5.2.C.7: subjects, operations and objects; role-based access control; rule-based access control; discretionary access control with owners and administrators; mandatory access control by subject and object level; the Bell-LaPadula model and its two properties; the principle of least privilege).