CompTIA SecurityX (CAS-005)Security ArchitectureMedium
A security architect is designing an access control system for a highly sensitive research facility that processes classified government data. The system must enforce a strict 'need-to-know' principle, where access decisions are based on the classification level of the information and the clearance level of the user, regardless of their role or group membership. Which access control model is most appropriate for this scenario?
- AMandatory Access Control (MAC)
- BDiscretionary Access Control (DAC)
- CRole-Based Access Control (RBAC)
- DAttribute-Based Access Control (ABAC)
Show answer & explanationAnswer & explanation
Correct answer: A. Mandatory Access Control (MAC)
Mandatory Access Control (MAC) is the most appropriate model for highly sensitive environments like classified government data. It enforces access based on security labels (e.g., classification levels) assigned to subjects and objects, and users cannot override these system-defined rules, ensuring the strict 'need-to-know' principle.
Why the other options are wrong
- B. DAC allows object owners to set permissions, which is too permissive and insecure for classified government data, as users could grant access to unauthorized individuals.
- C. RBAC grants access based on a user's role, which might not be granular enough to enforce strict classification and clearance levels independent of the role.
- D. ABAC is highly flexible using various attributes, but MAC is specifically designed for the hierarchical, non-discretionary enforcement required for classified information.
Mandatory Access Control (MAC)
An access control model where access decisions are dictated by a system-wide policy based on security labels (sensitivity levels) assigned to subjects and objects, which users cannot override.
- Often used in government, military, and highly secure environments.
- Enforces a 'need-to-know' principle rigidly.
- Common models include Bell-LaPadula (confidentiality) and Biba (integrity).
Memory trick: MAC: Mandatory for Classified, DAC: Discretionary for Users.