Access control is a fundamental security concept tested across all ISACA certifications. Understanding the four main models is essential.
The Four Access Control Models
1. Discretionary Access Control (DAC)
How it works: The resource owner decides who gets access.
Example: In Windows, you create a file and choose which users or groups can read, write, or execute it.
Characteristics:
Weakness: A user with access can grant it to others, potentially violating security policies.
2. Mandatory Access Control (MAC)
How it works: The system enforces access based on security labels (classifications). Users cannot change permissions.
Example: Military systems where documents are classified as Confidential, Secret, or Top Secret. Users with "Secret" clearance can access Secret and Confidential, but not Top Secret.
Characteristics:
Key models:
3. Role-Based Access Control (RBAC)
How it works: Access is assigned to roles, and users are assigned to roles. Users inherit the permissions of their role.
Example: A "Finance Manager" role has access to accounting systems, budgets, and financial reports. Anyone assigned to that role automatically gets those permissions.
Characteristics:
Best practice: Define roles based on job functions, not individuals. Review role assignments regularly.
4. Attribute-Based Access Control (ABAC)
How it works: Access decisions based on attributes (user attributes, resource attributes, environmental conditions).
Example: "Allow access to financial reports IF user department = Finance AND time = business hours AND location = corporate network."
Characteristics:
Comparison Table
How These Appear on Exams
CISA Questions
CISM Questions
CRISC Questions
Deep dive into access controls and security concepts with our CISM and CISA courses.