In this lesson,
we will learn about Rule-Based Access Control.
Rule-Based Access Control is used to manage user access
to resources based on predefined rules and conditions.
An example of Rule-Based Access Control
is the Mandatory Access Control model.
Mandatory Access Control or MAC
enforces strict access policies
based on predefined security classifications.
This limits user access based on the classification
of information and the user's clearance level.
Other access control models include
Discretionary Access Control or DAC
and Attribute-Based Access Control.
Discretionary Access Control allows resource owners
full control of resource access, enabling them to grant
or deny anyone access to their resources.
Attribute-Based Access Control uses the attributes of users,
resources, and the environment
to determine access permissions dynamically.
Let's learn about Rule-Based Access Control,
Mandatory Access Control, Discretionary Access Control,
and Attribute-Based Access Control.
Then we will have a demonstration
of Discretionary Access Control on a Linux machine.
First, we have Rule-Based Access Control.
Rule-Based Access Control manages user access
to resources based on predefined rules and conditions.
These rules are configured by administrators
and dictate who can access what and when.
Rule-based systems are flexible
and are often used in environments, where access needs
to be tightly controlled
based on specific conditions or actions.
For example, an enterprise might set a rule
that allows access to financial records only
during business hours.
With Rule-Based Access Control, administrators can also
implement security policies that apply to all users.
This makes it easy to change and update rules as needed.
For instance, access control lists on routers
or firewalls are examples of Rule-Based Access Control.
When administrators configure these rules,
they affect all users on a specific network segment,
applying the rules equally across the board
based on the policy set.
This approach provides consistent control over user access
within an organization's network.
Second, we have Mandatory Access Control or MAC.
MAC is a strict Rule-Based Access Control model
that enforces security policies based on classifications.
Users cannot change or alter these policies on their own.
Mandatory Access Control is commonly used in highly secure
environments like government
or military systems, where access
to sensitive information depends on a user's
security clearance.
Only administrators can set
and modify these access rules,
ensuring that users have access
to only the information they are authorized
to see based on their clearance level.
Mandatory Access Control operates
by assigning security classification labels
to both users and resources.
Each resource is classified
and users then must have an equal
or higher classification level to access it.
This type of access control is complex
and expensive to configure,
which is why it's typically reserved
for high security systems.
Every user and resource must have a security clearance
label, and access must be granted
based on matching those labels.
So for the system to function, users and objects
must be correctly labeled.
If a user's clearance does not meet the classification level
of a resource, access is blocked.
For example, if a user holds a secret clearance,
they can access resources classified as secret,
confidential, or unclassified,
but they will be denied access
to anything labeled top secret.
The configuration of Mandatory Access Control
requires predefined rules,
which are rigid and cannot be changed
by individual users; only the system
and its administrators can modify these labels.
Mandatory Access Control is supported
by specialized systems like SELinux,
which is a security enhanced version
of Linux developed by Red Hat.
In partnership with the National Security Agency,
SELinux provides Mandatory Access Controls
and other security policies by modifying the Linux kernel,
offering additional layers of protection.
Third, we have Discretionary Access Control or DAC.
DAC is the default access control method used in both
Windows and Linux operating systems.
Discretionary Access Control allows the owner of a resource,
like a file or folder,
to control who can access that resource.
In an enterprise, a user might create a document
and then decide who can read, edit, or delete it.
This flexibility makes Discretionary Access Control easy
to manage as the resource owner
has full control over its permissions.
With Discretionary Access Control,
the resource owner can specify which users have access
to each resource they own based on their
identity or profile.
This is often considered a need to know model
where access is granted based on the owner's discretion.
So while Discretionary Access Control provides flexibility
for the owner, it can be less secure
as users can grant permissions freely,
which if not managed carefully,
could lead to unauthorized access.
Fourth and last, we have
Attribute-Based Access Control or ABAC.
ABAC is more dynamic and flexible
than both Mandatory Access Control
and Discretionary Access Control.
Attribute-Based Access Control or ABAC grants
access based on a combination
of attributes related to the user, the resource,
and the environment.
For instance, in an enterprise setting,
Attribute-Based Access Control might allow access
to a system based on a user's role, department,
and the location they are logging in from.
This flexibility allows organizations
to configure detailed access policies
such as granting access to human resources
documents only if the user is part
of the human resources team,
and if they're logging in from the corporate office
during business hours.
This makes Attribute-Based Access Control highly adaptable
in complex environments,
where many factors must be considered.
Attribute-Based Access Control relies on various attributes
to make access control decisions.
User attributes can include details like username, role,
organization, ID, or security clearance.
Environmental attributes might involve the time of access,
the user's location,
or the current security level of the organization.
Resource attributes could also include the file's
creation date, the resource owner, the file name,
or the data sensitivity level.
Based on these attributes, access is granted
or denied depending on the specific combination
of factors being evaluated.
For example, your company's SharePoint site might display
different content based on your user profile
and whether you are accessing it from the corporate office
or remotely through a Virtual Private Network.
This dynamic approach allows Attribute-Based Access Control
to adjust access in real time, making it an ideal choice
for organizations with complex security needs.
I am on a Kali Linux virtual machine
and am opening up a terminal.
Let's explore Discretionary Access Control or DAC,
meaning that the owner of a file
has full control of its permissions.
First, I'll create a file called myDACfile.text.
In Linux, file extensions like Doc TXT are not required,
but may still be used by convention.
Next, let's take a look at the current file permissions.
As you can see, the owner, me, which is the Kali user,
has read write permissions on the file.
The group associated with this file,
Also, the Kali user group has read write permissions
as well, and everyone else,
all others has only read permissions.
In Discretionary Access control,
the owner, me, the Kali user,
has full control over the permissions of the file
that I, the owner just created.
To demonstrate this, I'm going to give myself read, write,
and execute permissions on this file
and take all permissions away from all groups
and all other users.
I'll do that with the chmod command.
Alright, let's take a look
and see what permissions have changed.
As you can see, I, the Kali owner and user
have read, write, and execute permissions
and all other permissions from all other users
have been taken away.
Next, I'll assign ownership of the myDACfile
to the root user.
Since it's my file
and we are using Discretionary Access Control,
I can change file group assignments
or even give away file ownership.
I'll do this with the chown command,
and I'll assign it to the root user.
All right, let me enter in my password
and let's take a look at the file permissions,
which have changed.
As you can see here, I've given away ownership of the file
to the root user.
In Discretionary Access Control, ownership
was mine to give away.
So remember, Rule-Based Access Control manages user access
by enforcing predefined rules set by administrators.
These rules determine who can access resources
and under what conditions, offering flexibility
and control in environments,
where access must be tightly managed.
Mandatory Access Control is a strict rule-based model
that enforces security policies
based on classifications.
Only administrators can modify access rules making MAC
or Mandatory Access Control ideal
for high security environments like government systems.
Next, Discretionary Access Control gives resource owners
full control over who can access their files, allowing them
to grant or deny access at their discretion.
While flexible Discretionary Access Control can be less
secure as permissions are freely assigned
by the content owners.
Finally, Attribute-Based Access Control is more dynamic
granting access based on a combination of attributes related
to the user, resource, and environment,
making it highly adaptable
for complex security needs.