CompTIA SecurityX (CAS-005)Security EngineeringMedium
A security engineer is tasked with implementing a robust access control mechanism for a new cloud-based application that processes highly sensitive customer data. The application will be accessed by internal employees, external partners, and customers, each requiring different levels of access based on their roles and specific tasks. The engineer needs to ensure that access decisions are dynamic, based on multiple attributes of the user, resource, and environment at the time of access. Which access control model would BEST meet these requirements?
- ADiscretionary Access Control (DAC)
- BMandatory Access Control (MAC)
- CAttribute-Based Access Control (ABAC)
- DRole-Based Access Control (RBAC)
Show answer & explanationAnswer & explanation
Correct answer: C. Attribute-Based Access Control (ABAC)
Attribute-Based Access Control (ABAC) is the best choice for dynamic access decisions based on multiple attributes of the user, resource, and environment. This allows for fine-grained control necessary for diverse user groups accessing sensitive data.
Why the other options are wrong
- A. DAC allows resource owners to define access permissions, which can lead to inconsistent security policies and is not suitable for centralized, dynamic control over sensitive data.
- B. MAC enforces a strict, system-wide access policy based on sensitivity labels, which is typically too rigid for a cloud-based application with varied internal and external users needing dynamic access.
- D. RBAC assigns permissions based on roles, which can be too static and less flexible for highly dynamic and granular requirements involving multiple attributes.
Attribute-Based Access Control (ABAC)
A dynamic access control model that grants or denies access based on a combination of attributes associated with the user, resource, action, and environment.
- Provides fine-grained access control.
- Highly flexible and scalable for complex environments.
- Access decisions are evaluated at the time of the request.
Memory trick: Attributes Bring Access Control.