Domain 3 of 5 · Chapter 2 of 2

Apply Logical Access Controls

Unlock the complete study guide + 12 practice exams totaling 1,500 questions.

Bundled into the existing Certified in Cybersecurity premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • One request, three design rules
  • Least privilege: only what the task needs
  • Least privilege for privileged accounts
  • Separation of duties: splitting incompatible duties
  • Static, dynamic and two-person enforcement
  • Access control models: who decides, on what basis
  • Discretionary access control (DAC)
  • Mandatory access control (MAC)
  • Role-based access control (RBAC)
  • Attribute-based access control (ABAC)
  • How systems enforce access decisions
  • Horizontal and vertical privilege escalation
  • Authentication factors and MFA
  • Risk signals and behavioral analysis
  • Keeping MFA from being bypassed

Access control models: DAC vs MAC vs RBAC vs ABAC

QuestionDiscretionary access control (DAC)Mandatory access control (MAC)Role-based access control (RBAC)Attribute-based access control (ABAC)
Who decides access?The object's owner, or another subject authorized to control the objectA central authority, through policy that individual owners cannot changeAdministrators who define roles and assign users to themPolicy written in terms of attributes and conditions
What does the decision rest on?The owner's choices, recorded per objectThe object's sensitivity label compared with the user's formal authorization (clearance)The roles assigned to the subject, each carrying a set of permissionsSubject, object and environment attributes evaluated together
Typical scenarioA file owner picks which coworkers may read or edit a shared fileClassified records readable only by users cleared for that sensitivityPayroll clerks and help-desk technicians each receive their function's permission setA document opens only for its department, on a compliant device, from an approved location
Scenario cueThe owner decidesLabels and clearances, set centrallyPermissions come with the job roleDepends on device, location, time or other attributes
Tempting wrong answerRBAC, because the owner happens to have a job titleDAC, which would hand owners a discretion the central policy withholdsMAC chosen only because the roles are administered centrally: that alone does not establish MAC, and the role-based decision remains RBAC, which can be mandatory or discretionaryRBAC alone, which ignores device condition, location and other context

Decision tree

All four questions are asked; more than one can be answered yesIs access left to the discretionof the object's owner?Discretionary access control (DAC)subjects may grant their privileges to othersYesEither wayDoes a uniformly enforced policy decide,for example by labels and clearances?Mandatory access control (MAC)subjects constrained from granting privilegesYesEither wayIs access based on the defined role(job function) of the subject?Role-based access control (RBAC)can be mandatory or discretionaryYesEither wayIs access based on attributes of thesubject, object and environment?Attribute-based access control (ABAC)can be mandatory or discretionaryYesWhatever the model: least privilege, separation of duties, default deny
Cheat sheet

Cheat sheet

  • Least privilege limits both accessible resources and permitted actions
  • Administrators use nonprivileged access for ordinary tasks
  • Just-in-time access limits how long elevated permission exists
  • Automated workloads need only the permissions their tasks require
  • Least privilege limits what a compromised account can reach
  • Elevated software can indirectly expand a user's authority
  • Privileged activity needs logging even when it is authorized
  • Separation of duties divides incompatible responsibilities
  • Dual authorization requires two authorized people for a sensitive action
  • Duty separation can restrict role assignment or role activation
  • Access-control administration and audit administration should be separated
  • Separation-of-duties conflicts can cross system boundaries
  • Collusion can defeat separation of duties
  • Discretionary access control lets owners decide access
  • Mandatory access control enforces centrally governed security policy
  • Role-based access control assigns permissions through roles
  • Role hierarchies can pass permissions to other roles
  • Attribute-based access control evaluates attributes and request context
  • Subject, resource, and environment attributes describe different parts of a request
  • Roles collect permissions while groups collect users
  • Access control lists record who may do what to a resource
  • Subjects request operations on protected objects
  • Logical access controls enforce access within systems and applications
  • Default deny rejects access without an applicable grant
  • Authorization checks apply to each resource request
  • A successful login does not authorize every action
  • Unauthorized peer access differs from unauthorized elevated access
  • Multifactor authentication combines distinct factor categories
  • Risk-based authentication can request extra verification for unusual access
  • Impossible travel flags geographically inconsistent login activity
  • Behavioral access alerts depend on a meaningful baseline
  • MFA recovery must not become an easier account-takeover path
  • Phishing-resistant authentication ties the proof to the legitimate service
  • Repeated unexpected MFA prompts can signal an authentication fatigue attack
  • AI can strengthen authentication by assisting behavioral analysis

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://www.isc2.org/certifications/cc/cc-certification-exam-outline
  2. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
  3. https://csrc.nist.gov/glossary/term/subject
  4. https://csrc.nist.gov/glossary/term/object
  5. https://csrc.nist.gov/glossary/term/authentication
  6. https://csrc.nist.gov/glossary/term/authorization
  7. https://csrc.nist.gov/glossary/term/least_privilege
  8. https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html
  9. https://csrc.nist.gov/glossary/term/privileged_user
  10. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a
  11. https://csrc.nist.gov/glossary/term/separation_of_duty
  12. https://csrc.nist.gov/projects/role-based-access-control/faqs
  13. https://csrc.nist.gov/glossary/term/two_person_control
  14. https://csrc.nist.gov/glossary/term/mandatory_access_control
  15. https://csrc.nist.gov/glossary/term/discretionary_access_control
  16. https://csrc.nist.gov/glossary/term/role
  17. https://csrc.nist.gov/glossary/term/group
  18. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-162.pdf
  19. https://csrc.nist.gov/glossary/term/access_control_list
  20. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf
  21. https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/05-Authorization_Testing/03-Testing_for_Privilege_Escalation
  22. https://csrc.nist.gov/glossary/term/multi_factor_authentication
  23. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63B-4.pdf
  24. https://csrc.nist.gov/glossary/term/phishing_resistance
  25. https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html
  26. https://csrc.nist.gov/glossary/term/private_key
  27. https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a