ISC2 Certified in Cybersecurity (CC)Access Controls ConceptsHard
A government agency is implementing an access control system for classified documents. The system must ensure that a user with a 'Secret' clearance can read documents classified as 'Secret' or 'Confidential', but cannot read 'Top Secret' documents. Conversely, a user with 'Top Secret' clearance can read all documents. Users cannot downgrade a document's classification or grant themselves higher access. Which access control model does this scenario best represent?
- AMandatory Access Control (MAC)
- BAttribute-Based Access Control (ABAC)
- CDiscretionary Access Control (DAC)
- DRole-Based Access Control (RBAC)
Show answer & explanationAnswer & explanation
Correct answer: A. Mandatory Access Control (MAC)
This scenario describes a classic implementation of Mandatory Access Control (MAC), specifically a Bell-LaPadula model. Access is based on security labels (clearance levels and document classifications), with strict rules preventing users from downgrading classifications or gaining unauthorized access, characteristic of MAC.
Why the other options are wrong
- B. ABAC uses attributes but MAC is the most precise fit for this specific type of hierarchical classification and non-discretionary control.
- C. DAC allows owners to set permissions, which is explicitly forbidden in this scenario.
- D. RBAC assigns permissions based on job roles, not strict hierarchical security classifications like 'Secret' or 'Top Secret' that prevent downgrading.
Mandatory Access Control (MAC)
An access control model where access decisions are centrally controlled by the system based on security labels assigned to subjects (users) and objects (resources). Users cannot alter these labels or access permissions.
- Often used in military and government for classified information.
- Implements strict hierarchical security policies (e.g., Bell-LaPadula model).
- Prevents information flow from higher security levels to lower ones (no read-up, no write-down).
Memory trick: MAC is for military-grade, no-nonsense classification.