Principles of Information Security: Authorization Models (RBAC, ABAC, MAC, DAC)

Authorization Models (RBAC, ABAC, MAC, DAC)

Authorization Models (RBAC, ABAC, MAC, DAC) – Exam-Ready Study Guide

What This Is

Authorization models define who can access what resources and how—a cornerstone of access control. Without proper authorization, attackers (or insiders) can escalate privileges, steal data, or disrupt systems. Real-world example: The 2020 Twitter breach occurred when attackers socially engineered employees to gain access to internal admin tools (DAC misconfiguration), leading to high-profile account takeovers (e.g., Barack Obama, Elon Musk). Proper authorization (e.g., RBAC or ABAC) could have limited the blast radius by enforcing least privilege.

Key Terms & Concepts

• Authorization: The process of granting or denying access to resources based on a user’s identity and permissions (post-authentication). Contrast with authentication (proving who you are, e.g., passwords, MFA).
• Access Control: The broader framework for managing identification, authentication, authorization, and accountability (IAAA). Standards: NIST SP 800-53 (AC family), ISO 27001 (A.9).
• RBAC (Role-Based Access Control): Permissions are assigned to roles (e.g., "HR Manager," "Database Admin"), not individual users. Users inherit permissions via role membership. Example: AWS IAM Roles, Active Directory groups.
• ABAC (Attribute-Based Access Control): Access is granted based on attributes (user, resource, environment, or action). Example: "Allow access to patient records if (user.department = 'Nursing' AND resource.sensitivity = 'Low' AND time = '9 AM–5 PM')." Tools: Open Policy Agent (OPA), AWS IAM Policies (with conditions).
• MAC (Mandatory Access Control): Access is enforced by system-enforced labels (e.g., "Top Secret," "Confidential"). Users cannot override these rules. Example: Military systems (e.g., SELinux, Windows Mandatory Integrity Control).
• DAC (Discretionary Access Control): Owners of resources (e.g., files, folders) decide who gets access. Example: Unix/Linux file permissions (chmod), Windows NTFS permissions. ⚠️ High risk of privilege creep if not audited.
• Least Privilege: Users/processes get only the minimum permissions needed to perform their tasks. Violation example: A developer with full admin rights to production databases.
• Separation of Duties (SoD): Critical tasks require multiple people to prevent fraud/errors. Example: One person approves a payment; another executes it.
• Privilege Escalation: Attackers exploit misconfigurations to gain higher access. Types: Vertical (user → admin), Horizontal (user A → user B’s data). Example: CVE-2021-4034 (PwnKit).
• Policy Decision Point (PDP) vs. Policy Enforcement Point (PEP):
• PDP: Evaluates access requests (e.g., "Does this user meet ABAC rules?").
• PEP: Enforces the PDP’s decision (e.g., "Deny access to the file").
• OWASP Access Control Cheat Sheet: Best practices for implementing authorization in web apps (e.g., deny by default, secure direct object references).
• MITRE ATT&CK T1548 (Abuse Elevation Control Mechanism): Techniques attackers use to bypass authorization (e.g., token manipulation, sudo caching).

Step-by-Step: Implementing Authorization Models

1. Assess Requirements (CIA + Compliance)

• Confidentiality: What data needs protection? (e.g., PII, trade secrets).
• Integrity: Who can modify critical data? (e.g., financial records).
• Availability: Who can delete/block resources? (e.g., backup admins).
• Compliance: Does the system need MAC (e.g., DoD) or RBAC (e.g., HIPAA)?

2. Choose the Right Model

3. Design & Document Policies

• RBAC: Define roles (e.g., "Auditor," "Developer") and map permissions.
  Tool: Microsoft Identity Manager (MIM), Okta.
• ABAC: Write policies using attributes (e.g., user.department == "Finance" AND resource.type == "Invoice").
  Tool: Open Policy Agent (OPA), AWS IAM Conditions.
• MAC: Assign labels (e.g., "Secret," "Unclassified") and enforce rules.
  Tool: SELinux, Windows Mandatory Integrity Control.
• DAC: Set owner/group/others permissions (e.g., chmod 750 file.txt).
  Tool: Linux ACLs (setfacl), Windows NTFS permissions.

4. Implement & Test

• Deploy: Configure the model in your system (e.g., IAM roles, SELinux policies).
• Test: Use penetration testing (e.g., Burp Suite, Metasploit) to verify:
  • No privilege escalation (e.g., sudo -l in Linux).
  • No insecure direct object references (IDOR) (e.g., changing user_id=123 to user_id=124 in a URL).
• Audit: Log all access attempts (e.g., SIEM integration).

5. Monitor & Maintain

• Review: Quarterly access reviews (e.g., NIST SP 800-53 AC-2).
• Update: Adjust policies for new threats (e.g., MITRE ATT&CK T1548).
• Automate: Use PAM (Privileged Access Management) tools (e.g., CyberArk, BeyondTrust) for high-risk accounts.

Common Mistakes

Certification Exam Tips

CISSP

• Management vs. Technical: CISSP focuses on designing authorization models, not configuring them. Example question:

  "Which authorization model is best for a healthcare system where access depends on patient-doctor relationships and time of day?" Answer: ABAC (context-aware attributes).

  
  

• MAC vs. DAC: Know that MAC is system-enforced (e.g., military), while DAC is user-controlled (e.g., file permissions).
• RBAC Scalability: RBAC struggles with dynamic environments (e.g., cloud). ABAC is better for fine-grained access.

Security+

• Ports & Protocols: Authorization often ties to LDAP (389/636), Kerberos (88), or SAML (443). Know these ports!
• Scenario-Based Questions: Example:

  "A company wants to restrict access to financial data based on department, location, and time. Which model fits best?" Answer: ABAC (attributes = department, location, time).

  
  

• DAC vs. RBAC: DAC is owner-controlled (e.g., chmod), while RBAC is role-based (e.g., "HR Manager").

CEH

• Attacker Perspective: CEH tests how attackers bypass authorization. Example:

  "Which technique exploits weak DAC permissions to gain root access?" Answer: Privilege escalation via sudo misconfigurations* (e.g., sudo -l).

  
  

• Tools: Know Metasploit modules (e.g., exploit/linux/local/sudo_baron_samedit) for testing authorization flaws.

Quick Check Questions

1.

A financial institution needs to ensure that only traders in the "Equities" department can access stock trading systems between 9 AM and 4 PM. Which authorization model is most appropriate? - A) RBAC - B) ABAC - C) MAC - D) DAC Answer: B) ABAC
Explanation: ABAC uses attributes (department, time) to enforce dynamic access rules.

2.

During a penetration test, you discover that a Linux server allows any user to run sudo vim to edit system files. Which authorization model is misconfigured, and what is the risk? - A) RBAC – privilege escalation - B) DAC – privilege escalation - C) MAC – data leakage - D) ABAC – policy bypass Answer: B) DAC – privilege escalation
Explanation: DAC (file permissions) is misconfigured, allowing users to escalate privileges via sudo.

3.

A government agency handling classified data must enforce system-enforced access controls where users cannot override permissions. Which model should they use? - A) RBAC - B) ABAC - C) MAC - D) DAC Answer: C) MAC
Explanation: MAC uses system-enforced labels (e.g., "Top Secret") and prevents user overrides.

Last-Minute Cram Sheet

1. RBAC: Roles → Permissions (e.g., "Admin," "User"). Tool: Active Directory groups.
2. ABAC: Attributes → Access (e.g., user.department == "HR"). Tool: OPA, AWS IAM Conditions.
3. MAC: System-enforced labels (e.g., "Secret"). Tool: SELinux, Windows Mandatory Integrity.
4. DAC: Owner-controlled (e.g., chmod 755). ⚠️ Risk: Privilege creep.
5. Least Privilege: Minimum permissions needed. Violation: "Everyone" group in Windows.
6. Separation of Duties (SoD): Critical tasks require 2+ people. Example: Payment approval + execution.
7. Privilege Escalation: Vertical (user → admin) or horizontal (user A → user B). Example: sudo -l exploits.
8. PDP vs. PEP: PDP decides; PEP enforces. Example: ABAC policy engine (PDP) + firewall (PEP).
9. OWASP Top 10 A01:2021: Broken Access Control (e.g., IDOR, forced browsing).
10. MITRE ATT&CK T1548: Abuse Elevation Control (e.g., token manipulation, sudo caching). ⚠️ Common in exams!

Final Tip: For exams, memorize the "best use case" for each model (e.g., MAC = military, ABAC = healthcare). In the real world, combine models (e.g., RBAC + ABAC for cloud environments).