-: Access Control Models.
In this lesson, we are going to talk
about the four access control models.
They are DAC, MAC, RBAC, and ABAC.
The first one we're going to talk about is DAC.
DAC is Discretionary Access Control.
This is an access control policy
that's determined by the owner.
Every file out there and every folder
is considered an object, and then you,
the user, is considered an owner
or whoever owns that file or folder.
Now, the owner gets to decide
who gets to read that.
So, on this example, for instance,
I have a folder and inside this folder
it's owned by Jason.
Jason has decided that I can read
and write it because I'm Jason
but my staff members can only read it,
and everybody else on the network
can only read it.
This is why DAC is commonly used
because you have very granular control
to decide who has access
to the things you've created.
This works great if you want to be able to tell
who can use which files and which folders,
as the person who created it.
Now, the problem with this is that you have
to have two things being met.
First, every object in a system
has to have an owner.
Nothing can be out there without an owner
because if it had no owner,
nobody would know who had
the right permissions to it
because the owner sets the permissions.
And second, you need to make sure
that each owner determines the access
rights and permissions for each object.
If I'm the owner of a file
and I never set permissions on it,
nobody is going to be able to read it.
And if I set those permissions too tightly,
I can keep people out.
Or if I set them too loosely,
everyone can get access to it.
So, the owner really has a lot of control here.
So, in corporate systems, this can be dangerous
and you have to think about
if you want to use this model.
Now, the next model we're going to have
is called MAC.
It goes all the way on the other extreme.
MAC is going to be Mandatory Access Control.
It's an access control policy
where the computer system gets to decide
who gets access to what objects.
Now, how does it do that?
Well, with Discretionary Access Control
you, the owner, got to choose who got permissions.
But in MAC, the computer's going to do that for you
and it does this through data labels.
So, with MAC, data labels create this trust level
for all subjects and all objects.
So, every person out there gets a label
of if we have high trust, medium trust
or low trust for them,
and each data object gets a label, as well,
high trust, medium trust, or low trust.
So, how does this work in the real world?
Well, the most common use
of Mandatory Access Control is in military context
for high security systems.
So, if you've seen a war movie
at any time in your life,
you've probably seen the words
'top secret' on some document.
Well, there's really four levels of documentation
inside the military context.
They have the unclassified level.
They have the confidential level.
They have the secret level.
And then, they have the top secret,
which is the most secret.
Now, each person gets a clearance level
of what they're allowed to see.
So, maybe the private only gets to see
confidential information,
and maybe the colonel, he gets to see
the top secret information,
and the captain only gets to see the secret.
And so, each person gets a label
associated with them and their clearance,
and then the documents all get labeled
with whatever they are,
unclassified, confidential, secret, or top secret.
Now, if somebody wants to see a top secret document,
they can only read it
if they have a top secret clearance.
If they have a confidential clearance,
that's too low, they can't see it.
If I had a secret document,
then secret people and top secret people
could read it.
And so, that's the way it works.
It compares the labels
and if you have a minimum or above,
you can get to it.
Now, in MAC systems, they add
another piece to that, though.
If you want to access something,
you need to not just meet the minimum level,
but you also have to have what's called
a need-to-know.
So, for instance, let's say I have
an army guy and a navy guy,
and they both have a top secret clearance
but it's about a navy operation.
Then, maybe that army guy
doesn't need to know about it,
and he's not going to get access.
Even though he has that clearance, right?
So, these labels are very in-depth
and they get very, very complicated.
That's the idea here with MAC.
Now, MAC is implemented through one of two ways.
It can be Rule-based or it can be Lattice-based,
and these are two different access control methods
that are sub-methods of Mandatory Access Control.
So, if you see rule-based or lattice-based,
those are both Mandatory Access Control
and rely on data labels.
Now, in Rule-based Access Control,
this is a label-based access control system
that defines whether access should be granted
or denied to objects by comparing
the object's label and the subject's label.
So, if I compare your label, top secret,
versus this document, top secret,
you then get access because it meets that rule.
Now, when I talk about lattice-based,
this is going to use a complex mathematics
to create a set of objects and subjects
and define how they all interact.
This tries to get after that need-to-know piece, as well.
Again, for the exam, if you remember
that lattice and rule-based
are both types of Mandatory Access Control,
that's about as far as you need to get on that.
Now, Mandatory Access Control does exist
in a couple of operating systems.
You can implement it
inside the FreeBSC operating system
and you can implement it in SELinux.
Notice, I didn't say Windows.
That's because Windows uses
Discretionary Access Control,
as well as some other types
we're going to talk about in the future.
Now, we only see this Mandatory Access Control,
this data labeling used in high-security systems
because it's very expensive
and very complex to maintain,
and for that reason, we don't usually use it.
Now, in an organization,
the one that we use almost exclusively
is known as RBAC, Role-Based Access Control.
Role-Based Access Control is an access model
that's controlled by the system,
like MAC does, but instead, it focuses
on a set of permissions
vice an individual's permissions.
So, we don't have to actually label
each individual person on every single file.
Instead, we can use roles for those people.
So, the way I like to think about this
is we create roles for each job function,
and then we assign roles
for each person's permissions to each object.
So, let me give you an example.
Let's say you go in your company,
there's the sales department,
and then there's the HR department,
and then there's the IT department.
So, we've got these three departments.
Does the sales people need to have access
to the human resource people's files?
Probably not.
Does the HR people need to have access
to the sales people's files?
Probably not.
Does IT need to have access to everybody's files?
Probably, if they're going to do
all the data backups and maintenance, right?
And so, what we do is we create
these different groups,
and then those groups get a set of permissions,
and those are applied
to the different files and folders.
Also, when we do this,
we add or remove people into these roles
instead of onto those particular files.
So, going back to my earlier example,
I had a file on the shared drive
and you saw that Jason
was added to it individually.
That's a bad practice.
In role-based, we would, instead,
have an owners group.
We would have an admin group.
We would have an IT group.
We would have a sales group,
whatever all those groups are.
And we put the people who have the same job
into the same functions,
and we control permissions that way.
So, the whole idea here with role-based
is that we set permissions
based on the job function.
What is the role that person is doing?
I'll give you a good example of this.
There's a role-based group called power users.
Power users are people who aren't a normal user
but they're not an administrator, either.
They're somewhere in the middle.
For example, an administrator might have
full access to do whatever they want on a system,
whereas a user might only be able
to operate the programs that currently exist,
but they can't make configuration changes
like changing the time or adding a printer.
Well, a power user has a little bit
more permissions than a regular user
and they can do things like changing the time,
or they can add a printer to the network.
That's the idea here.
So, we can put different users
into that power users group
and they would then inherit those permissions
and be able to do those functions.
That's the idea here with role-based permissions.
The last one we have is ABAC,
and ABAC stands for Attribute-Based Access Control.
This is an access control model
that's dynamic and context-aware,
and uses if-then statements
to decide on what permissions to use.
So, the idea here is that we have something like,
if Jason is in HR, then we'll give him access
to the file server that contains the HR files.
Attributes are going to use these tags
and dynamic authentication
to combine different attributes,
and they can do this using all sorts
of different software automation,
and this is one of the newest forms of access control.
It's not heavily used in a lot of places yet
but it is trying to gain a lot of traction.
The idea here is that we can look at Jason
and we can start saying, is he part of this,
is he part of this, is he part of this?
And if so, we can get a consolidated list
of all the things Jason can do
and give him permissions to that.
That's the idea with attribute-based.
When you think of attribute-based,
I want you to think of dynamic authentication and tags
because this is all about tagging things
so you can give them the right permissions.