Authorization and Access Control Models

Question 1

Authentication vs Authorization

Answer 1

Authentication: You are who you say you are

Authorization: You have permission to do what you are attempting

Question 2

Discretionary Access Control

Answer 2

The creator of a file assigns permissions to specific users and groups
-DACL: Discretionary Access Control List

Question 3

Mandatory Access Control

Answer 3

More complex then other models, not often used.

Files are assigned a label (Public, Secret, Top Secret)

Users are assigned access levels (1, 2, 3)

Certain access levels can modify certain labels

ie; a User with Level 1 Access can access Public, Secret, and Top Secret files

a user with Level 2 Access can only access Public and Secret files

Question 4

Role Based Access Control

Answer 4

A policy is created defining roles and the access level within those roles

Users are then assigned to a given role

ie: the Marketing Role has access to Marketing Resources, HR to HR Resources, etc.

Question 5

Rule Based Access Control

Answer 5

Administrator configures rules and actions

Think of a firewall using if/then/else logic