Home › Identity & Access Management
Rule-Based Access Control (RuBAC) Explained — Access Control Models (Part 5)
Identity & Access ManagementCISSPSecurity+
Rule-Based Access Control (RuBAC) decides access by predefined rules, restrictions, and filters — not by who you are or what role you hold. In this video we break down how RuBAC works, why it's a nondiscretionary model, and why the firewall ACL is its textbook example. We also clear up the single most common mix-up on the exam: rule-based versus role-based access control.
What you will learn
- What Rule-Based Access Control (RuBAC) is and how "if-this-then-that" rules work
- Why RuBAC applies global rules to all subjects equally (and why it's nondiscretionary)
- The rule-based vs. role-based (RBAC) naming trap and how the CISSP outline separates them
- Firewalls, routers, and ACLs — implicit deny, implicit allow, and first-match rule order
- Content-dependent vs. context-dependent access control
- Where RuBAC sits among DAC, MAC, RBAC, ABAC, and risk-based models
- RuBAC's key limitation and why ABAC extends it