CompTIA Security+ Preparation · lesson 10 of 45 · 25 min
Authorization vs Authentication
Authentication — verifies WHO you are (identity). “Are you really Alice?”
Authorization — determines WHAT you can do (access rights). “What can Alice access?”
Accounting — records WHAT you did (audit trail). “What did Alice do?”
Together these form the AAA framework (Authentication, Authorization, Accounting) — the foundation of access control.
Access Control Models
DAC (Discretionary Access Control) — the resource owner controls access. Owner can grant/revoke permissions to others at their discretion. Example: Windows/Linux file permissions where the file owner sets who can read/write. Flexible but hard to manage at scale. Vulnerable to Trojan horse attacks.
MAC (Mandatory Access Control) — access is controlled by the system based on security labels. Users cannot change access permissions. Example: military systems with classification levels (Unclassified, Secret, Top Secret). Bell-LaPadula model: “no read up, no write down” (confidentiality). Biba model: “no write up, no read down” (integrity). Very rigid — used in high-security environments.
RBAC (Role-Based Access Control) — access based on job role/function. Users are assigned to roles; roles have permissions. Example: “HR Manager” role has access to HR systems; “Developer” role has access to code repositories. Most common model in enterprise environments. Easier to manage than DAC.
ABAC (Attribute-Based Access Control) — access based on attributes of the user, resource, and environment. Most flexible and fine-grained. Example: “Allow access if user.department=Finance AND resource.classification=Confidential AND time.hour is between 9 and 17.” Used in cloud environments and zero trust architectures.
Rule-Based Access Control — access based on rules set by the administrator (not the owner). Example: firewall ACLs. Often confused with RBAC — note the difference.
Key Terms
Key Terms
Knowledge Check — 12 Questions
Security+ — Authorization Models
In DAC, who controls access to a resource?
- The system administrator
- The security officer
- The resource owner
- The operating system
Answer: The resource owner
DAC (Discretionary Access Control) — the owner of the resource decides who can access it and what permissions they have.
MAC is used in military systems because:
- It is the most flexible model
- Access is controlled by security labels — users cannot override permissions
- It is the easiest to manage
- It is based on job roles
- Answer: Access is controlled by security labels — users cannot override permissions
MAC enforces strict classification-based access — a user with Secret clearance cannot access Top Secret data regardless of their wishes. The Bell-LaPadula model enforces:
- Integrity — no write up, no read down
- Confidentiality — no read up, no write down
- Availability — no deny access
- Authentication — verify identity first
- Answer: Confidentiality — no read up, no write down
Bell-LaPadula: subjects cannot read data at a higher classification (no read up) and cannot write to lower classifications (no write down) — prevents leaking classified data. RBAC assigns permissions to:
- Individual users directly
- Roles, which are then assigned to users
- Resources based on attributes
- Security labels
- Answer: Roles, which are then assigned to users
RBAC: permissions are assigned to roles (e.g., “HR Manager”), then users are assigned to roles. Changing a role updates all users in it. ABAC is most suitable for:
- Simple file systems
- Military classification systems
- Cloud environments requiring fine-grained, context-aware access control
- Small organizations
- Answer: Cloud environments requiring fine-grained, context-aware access control
ABAC evaluates multiple attributes (user, resource, environment, time) — ideal for complex, dynamic cloud and zero trust environments. The AAA framework stands for:
- Authentication, Authorization, Accounting
- Access, Audit, Administration
- Authentication, Access, Audit
- Authorization, Audit, Administration
- Answer: Authentication, Authorization, Accounting
AAA: Authentication (who are you?), Authorization (what can you do?), Accounting (what did you do?). Rule-based access control is commonly implemented in:
- HR systems
- Firewall ACLs
- Military databases
- Cloud IAM
- Answer: Firewall ACLs
Rule-based access control uses administrator-defined rules (like firewall ACLs) — not to be confused with RBAC (role-based).
In RBAC, if a user’s role is changed, their permissions automatically update.
- True
- False
Answer: True
RBAC’s key advantage: permissions are attached to roles, not users. Changing a user’s role immediately changes their access.
DAC is vulnerable to which type of attack?
- Replay attacks
- Trojan horse attacks — malware running as the user inherits their permissions
- Brute force attacks
- SQL injection
Answer: Trojan horse attacks — malware running as the user inherits their permissions
In DAC, malware running as a user gets all that user’s permissions — it can access and modify any resource the user owns.
The Biba model enforces:
- Confidentiality
- Integrity — no write up, no read down
- Availability
- Authentication
- Answer: Integrity — no write up, no read down
Biba: subjects cannot write to higher integrity levels (no write up) and cannot read from lower integrity levels (no read down) — prevents data corruption.
ABAC stands for _____ Access Control.
Answer: Attribute-Based
ABAC (Attribute-Based Access Control) makes access decisions based on attributes of the user, resource, and environment.
Which access control model is most commonly used in enterprise environments?
- DAC
- MAC
- RBAC
- ABAC
Answer: RBAC
RBAC is the most widely deployed enterprise model — it maps naturally to organizational structure (job roles) and is manageable at scale.
Try it: Access control models
Previous lesson: Authentication factors: something you know/have/are; MFA, passwordless
Back to CompTIA Security+ Preparation
Next lesson: Threat actors: nation-state, insider, hacktivist, criminal