Who may open the pay file?
A firm of 200 has one file with everyone's pay. Five people need it. The other 195 must not see it.
Who decides? The owner? The boss? A rule about jobs? A rule about time and place?
Four models give four different answers.
Key words
| Word | What it means |
|---|---|
| Firewall | A gate that lets some traffic in or out and blocks the rest. |
| Access control | Deciding who may use which resource, and how. |
| Resource | Anything a user may want to use, such as a file, a printer or a server. |
| Security level | A rank given to data or to a person, such as public, internal or secret. |
| Attribute | A fact about a user, a device or a situation, such as department or time of day. |
| Role | A job title that carries a set of rights, such as teacher or student. |
| MAC | Mandatory access control: access is set by security levels, and users cannot change it. |
| DAC | Discretionary access control: the owner of a resource chooses who may use it. |
| ABAC | Attribute-based access control: access depends on facts about the user, device and moment. |
| RBAC | Role-based access control: access depends on the user's role. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can describe MAC, DAC, ABAC and RBAC, and choose the right model for a situation.
Starter: IAAA
Have a go
Starter: IAAA
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: MAC and DAC
MAC is strict. Data has a security level and so does each person. A person may open data at their own level or lower. Users cannot change the rules. Armies and secure labs use it.
DAC is flexible. The owner of a file decides who may open it. A home folder, or a Linux file, works this way. It is simple, but owners can make mistakes, such as sharing with everyone.
Run: the owner sets the access
cd /tmp && echo "pay list" > pay.txt && chmod 640 pay.txt && ls -l pay.txtA command for the lesson’s lab terminal. It is shown here and not run.
What you should see
Note
A line starting -rw-r----- . The owner can read and write. The owner's group can read. Everyone else gets nothing. The owner chose this with chmod. That is DAC.
Cycle 2: RBAC and ABAC
RBAC gives rights to roles, and people get roles. All teachers can mark. All students can submit. When someone changes job, change the role. It scales well.
ABAC looks at attributes: who you are, what device you use, where you are, what time it is. Rule: "Finance staff, on a managed laptop, between 9 and 5." It is the most precise, and the most work to set up.
Run: a group acts like a role
groupadd -f payroll && (id aisha >/dev/null 2>&1 || useradd -M -G payroll aisha) && chgrp payroll /tmp/pay.txt && ls -l /tmp/pay.txt && su -s /bin/sh aisha -c "cat /tmp/pay.txt"A command for the lesson’s lab terminal. It is shown here and not run.