A security architect is designing a system for managing highly sensitive intellectual property (IP) within a research and development firm. The system requires that access to specific IP documents is not only restricted by user role but also by the sensitivity level of the document and the project the user is currently assigned to. Additionally, access decisions must dynamically adapt based on the user's location and the device's posture (e.g., managed vs. unmanaged device). Which access control model provides the most flexibility and granularity to implement these dynamic, context-aware policies?
- ARole-Based Access Control (RBAC)
- BMandatory Access Control (MAC)
- CAttribute-Based Access Control (ABAC)
- DDiscretionary Access Control (DAC)
Show answer & explanationAnswer & explanation
Correct answer: C. Attribute-Based Access Control (ABAC)
Attribute-Based Access Control (ABAC) is the most flexible and granular model for this scenario. It allows access decisions to be based on a combination of attributes of the subject (user role, project assignment, location), the object (document sensitivity), and the environment (device posture). This dynamic evaluation of multiple attributes enables context-aware policies that adapt in real-time.
Why the other options are wrong
- A. RBAC is based solely on roles, which is insufficient for combining sensitivity levels, project assignments, location, and device posture for granular, dynamic access decisions.
- B. MAC is very strict and suitable for multi-level security but typically static and less flexible for dynamic, context-aware attributes like user location or device posture.
- D. DAC gives control to resource owners, which is too decentralized and lacks the dynamic, context-aware enforcement needed for highly sensitive IP.
Attribute-Based Access Control (ABAC)
An access control model that grants or denies access based on the evaluation of attributes associated with the subject, object, action, and environment.
- Highly granular and flexible, supporting complex policy definitions.
- Enables dynamic, context-aware access decisions.
- Scales well for large, diverse ecosystems with varying access requirements.
Memory trick: Advanced access control is like a 'smart doorman' who checks all your 'badges' (attributes) and the 'weather' (environment) before letting you in.