SSCP Systems Security Certified PractitionerAccess ControlsHard
An organization is implementing a new system where access to highly confidential documents is granted based on a combination of the user's security clearance level, the document's classification, the user's department, and the time of day. For example, a 'Top Secret' document can only be accessed by a 'Top Secret' cleared user from the 'Research' department between 9 AM and 5 PM. Which advanced authorization mechanism is best suited for this scenario?
- AAttribute-Based Access Control (ABAC)
- BRole-Based Access Control (RBAC)
- CMandatory Access Control (MAC)
- DDiscretionary Access Control (DAC)
Show answer & explanationAnswer & explanation
Correct answer: A. Attribute-Based Access Control (ABAC)
Attribute-Based Access Control (ABAC) is designed for highly granular and dynamic authorization decisions based on multiple attributes of the subject (user's clearance, department), the object (document classification), and the environment (time of day). This flexibility is ideal for complex, context-aware access policies.
Why the other options are wrong
- B. RBAC assigns permissions based on roles, but struggles with the dynamic combination of user attributes, object attributes, and environmental conditions.
- C. MAC uses static security labels and clearances, but doesn't easily incorporate dynamic environmental attributes like 'time of day' or 'department' in such a granular fashion.
- D. DAC relies on resource owners defining permissions, which is not suitable for complex, centrally enforced rules based on multiple attributes.
Attribute-Based Access Control (ABAC)
An authorization mechanism that grants or denies access to resources based on policies that evaluate attributes of the subject, object, action, and environmental conditions.
- Provides highly granular and dynamic access control.
- Scales well for complex environments with many users, resources, and conditions.
- Policies are expressed as 'If-Then' rules based on attribute values.
Memory trick: ABAC: All By Attributes, Always Complex.