Forest Global Training Partners

Cyber Risks · PortSwigger Research

Access control security models

Summary: PortSwigger Research outlines four access control security models: programmatic access control, which stores a matrix of user privileges in a database and applies controls with reference to it; discretionary access control, where resource owners assign or delegate permissions to users and groups; mandatory access control, a centrally controlled system where users and owners cannot delegate or modify access rights, often associated with military clearance-based systems; and role-based access control, where named roles carry access privileges and users are assigned to one or more roles. The text notes that DAC can become very complex to design and manage because rights are defined per individual resource and user, while RBAC is most effective when there are enough roles to invoke access controls but not so many as to make the model unwieldy.

Why it matters: The model you pick sets who can grant access: in DAC, resource owners can delegate permissions themselves, while in MAC they have no ability to delegate or modify access rights at all - a distinction that decides whether a compromised owner account can widen access or not.

Read the original at PortSwigger Research ↗

Topics
Vulnerabilities & Patching
Related