mandatory access control (MAC) - Glossary (2024)

FAQs

Mandatory access control (MAC) - Glossary? ›

Mandatory access control (MAC) is a security strategy that restricts the ability individual resource owners have to grant or deny access to resource objects in a file system.

MAC is also called a non-discretionary access control model, which means that control isn't granted at the discretion of the user or file owner. The control mechanisms of the MAC model enable organizations to implement zero-trust principles. MAC is considered one of the most secure access control models.

NIST SP 800-192 under Mandatory access control (MAC) A means of restricting access to system resources based on the sensitivity (as represented by a label) of the information contained in the system resource and the formal authorization (i.e., clearance) of users to access information of such sensitivity.

In mandatory access control model, each file system object has a classification label such as, secret, top secret or confidential level. Each device and client is assigned a similar classification and clearance level. The security kernel determines the classification label of clients and resources.

Access Control Lists, abbreviated ACLs, are an additional method to grant specific permissions to certain users. Apple introduced this technology in Mac OS X 10.4 “Tiger”, but it can be found in other Unix® operating systems and Microsoft® Windows as well.

Firewalls are an example of rule-based access. Active Directory user profiles are a form of role-based access. Role and Rule-based controls are called Non-Discretionary controls.

Disadvantages:-

Regular Update Required: It requires regular updating when new data is added or old data is deleted. The administration is required to put some consideration into the MAC system and ACL list now and then. Lack of Flexibility: MAC system is not operationally flexible.

Role-based access control (RBAC) is an alternative approach to mandatory access control (MAC) and discretionary access control (DAC) for the purpose of restricting system access to authorized users. RBAC is policy neutral.

ABAC is a logical access control model that is distinguishable because it controls access to objects by evaluating rules against the attributes of entities (subject and object), operations, and the environment relevant to a request.

What are the 5 D's of access control? ›

But what are the 5Ds of access control? They deter, detect, deny, delay, and defend. Each is equally important. The security of your building, its assets, and most importantly, its people, are your top priority.

Access control and access control models

There are four types of access control methods: Mandatory Access Control (MAC), Role-Based Access Control (RBAC), Discretionary Access Control (DAC), and Rule-Based Access Control (RBAC or RB-RBAC).

Mandatory access control is a centrally-managed access system. MAC assigns each network user a security level. It also assigns objects on the network with security attributes such as clearance levels and group identities.

Mandatory access control (MAC) is a security strategy that restricts the ability individual resource owners have to grant or deny access to resource objects in a file system.

A MAC model determines access to resources using a hierarchical structure. It compares the security label of the user requesting access against the security label of the resource. Access is denied if the user's security label is lower than the resource's security label.

The main difference between discretionary access control and mandatory access control is the key factor of controlling resource access. In discretionary access control, access is controlled by the resource users, while in mandatory access control, access is controlled by the system.

Discretionary Access Control (DAC) is a strategy that grants users control over their own data. Unlike MAC, where access decisions are made by the system administrators or developers, DAC allows the data owners to decide who can access their data and what actions they can perform.

RBAC, also known as a non-discretionary access control, is used when system administrators need to assign rights based on organizational roles instead of individual user accounts within an organization.

Standard vs extended ACLs: There are two main categories of ACLs: standard ACL and extended ACL. The standard ACL does not differentiate between IP traffic; instead, it allows or blocks traffic based on the source IP address.