CompTIA SecurityX (CAS-005)Security EngineeringMedium
A large enterprise is migrating its legacy monolithic applications to a microservices architecture. The security team wants to implement granular access control policies based on user attributes, resource attributes, and environmental conditions (e.g., time of day, location, device posture). This approach should go beyond simple role-based access and provide dynamic authorization decisions at runtime. Which access control model is BEST suited for this advanced requirement?
- ADiscretionary Access Control (DAC)
- BRole-Based Access Control (RBAC)
- CAttribute-Based Access Control (ABAC)
- DMandatory Access Control (MAC)
Show answer & explanationAnswer & explanation
Correct answer: C. Attribute-Based Access Control (ABAC)
Attribute-Based Access Control (ABAC) provides a flexible and fine-grained authorization model that evaluates a set of attributes (user, resource, environment) at the time of access to make dynamic access decisions, perfectly fitting the requirement for granular, context-aware access control.
Why the other options are wrong
- A. DAC allows resource owners to determine access, which can be inconsistent and difficult to manage at scale in an enterprise microservices environment.
- B. RBAC assigns permissions to roles, and users are assigned roles, which is less granular and dynamic than what's required here.
- D. MAC enforces access based on sensitivity labels and clearances, typically found in highly secure government or military systems, and is too rigid for dynamic enterprise application needs.
Attribute-Based Access Control (ABAC)
An authorization model that grants access based on evaluating attributes (user, resource, environment) at the time of access, enabling highly granular and dynamic policies.
- Uses attributes of subjects, objects, actions, and environment
- Provides fine-grained, dynamic authorization decisions
- More flexible than RBAC for complex scenarios
Memory trick: ABAC: Attributes Bring Access Control.