Home › Identity & Access Management
Access Control Models Explained — Overview (Part 1)
Identity & Access ManagementCISSPSecurity+
Access control is how we grant or deny a subject's request to reach an object — a user, process, or device asking for a file, system, or resource. This is Part 1 of our Access Control Models series (CISSP Domain 5: Identity and Access Management): a direct overview of every model before we dive into each one in depth.
What you will learn
- The two broad categories: discretionary vs. non-discretionary
- Discretionary Access Control (DAC) — the owner decides
- Mandatory Access Control (MAC) — security labels and clearances, set by the system
- Role-Based Access Control (RBAC) — access by a user's role
- Rule-Based Access Control (RuBAC) — predefined rules (router/firewall ACLs)
- Attribute-Based Access Control (ABAC) — granular, attribute- and context-based decisions
- Risk-Based Access Control — dynamic decisions from a real-time risk score