Home › Identity & Access Management
Attribute-Based Access Control (ABAC) Explained — Access Control Models (Part 6)
Identity & Access ManagementCISSP
Attribute-Based Access Control (ABAC) is the most granular and flexible model in the access-control family — and one of the most tested. In this video we break down how ABAC evaluates attributes against a policy to make each access decision, why it's also called policy-based access control, and how it goes beyond RBAC and rule-based control. We cover the four attribute categories, the PDP/PEP architecture, the NIST SP 800-162 standard, and real-world uses from stateful firewalls to SDN/SD-WAN and MDM — all mapped to how the CISSP exam expects you to think.
What you will learn
- What ABAC is and why it's called policy-based access control
- The four attribute categories: subject, object, action, and context/environment
- How ABAC policies combine attributes with if-then logic
- Why ABAC is "advanced rule-based" — and how it differs from RBAC and rule-based control
- The architecture: Policy Decision Point (PDP) and Policy Enforcement Point (PEP)
- The NIST SP 800-162 standard and where XACML fits
- Real-world examples: stateful firewalls, SDN/SD-WAN, and MDM
- The "two-edged sword": flexibility vs. complexity, auditing, and attribute governance
- Exam tips for spotting when ABAC is the right answer