SYO-601 Access Controls/Control types

Discretionary Access Control (DAC)

An access control method in which the owner of the information or the resource has the authority to grant or restrict access to that resource based on their discretion. The owner can determine who can access the resource, and what operations (read, write, execute, etc.) they can perform on it.

Mandatory Access Control

When every resource is given a classification label, and every entity is assigned a certain clearance level. This is the form of access control used by gov't and military.

Role-Based Access Control

Defines roles for different entities and assigns permissions to a role. A user's permissions are then determined when they are assigned a role.

Rule-Based ACCESS Control

Defines access control lists (ACLs) such as allowlists or blocklists that specifically allow or block certain actions.

Attribute-Based Access Control (ABAC)

A method of regulating access to resources by evaluating a set of attributes associated with users, resources, and environmental conditions. Unlike traditional access control models like Role-Based Access Control (RBAC) which rely solely on user roles, ABAC uses attributes to provide more granular and flexible access control. (User, Resource, Action)

Measures that identify and alert about security incidents (e.g., intrusion detection systems, logs).

Measures that mitigate damage and restore systems after an incident (e.g., backups, incident response plans).

Measures that stop security incidents before they occur (e.g., firewalls, access controls).

Measures that discourage security violations (e.g., security policies, warnings).

Measures that provide alternative protections when primary controls are not feasible (e.g., additional monitoring when encryption isn't possible).