Security Concepts · Topic 5 of 8
Access Control Models and AAA
Compare discretionary, mandatory, nondiscretionary, rule based, time based, role based and attribute based access control, and learn how AAA fits in.
- 4 min
- AAA means authentication, authorization and accounting.
- Authentication proves identity, authorization grants rights, and accounting records activity.
- In DAC, the resource owner decides who has access.
What it is
An access control model is the rule set that decides who can use which resource.
Different models answer the question in different ways. Some let the owner decide, some let the system decide, and some use roles, rules, time or attributes.
Alongside the models sits AAA, which describes the steps of checking identity, granting rights and recording activity.
How it works
The models differ in who sets the rules and what information the decision uses.
AAA
AAA stands for authentication, authorization and accounting.
- Authentication proves who you are, for example with a password or certificate.
- Authorization decides what you may do after you are identified.
- Accounting records what you did, such as when you logged in and which commands you ran.
Protocols such as RADIUS and TACACS+ carry AAA between network devices and a central server. Cisco ISE is a common server for this role.
The classic models
Discretionary access control (DAC) lets the owner of a resource decide who gets access. A file owner who shares a folder with a colleague is using DAC. It is flexible, but users can make mistakes, and a compromised owner account can pass on access.
Mandatory access control (MAC) has the system enforce rules based on labels. Resources have a sensitivity label, such as confidential or secret, and users have a clearance.
Owners cannot override the rules. It is common in government and military settings.
Nondiscretionary access control is the general name for models in which a central authority, not the owner, sets the rules. Role based access control is the best known example.
Role, rule, time and attribute based models
| Model | Decision based on | Example |
|---|---|---|
| Role based (RBAC) | The role or job of the user | All helpdesk staff can reset passwords |
| Rule based | A fixed rule applied to everyone | Block all traffic from a listed address range |
| Time based | The time of the request | Contractors can log in only during working hours |
| Attribute based (ABAC) | Attributes of the user, resource and context | Allow if department is finance and the device is managed |
Role based control scales well. You assign rights to a role once, then place users in the role. When someone changes job, you change their role.
Rule based control applies rules set by an administrator, often as conditions on traffic or requests. A firewall access list is a familiar example.
Time based control adds a schedule. It can be combined with the other models, so a rule applies only at certain times.
Attribute based control is the most flexible. It evaluates attributes such as user department, device health, location and the sensitivity of the resource, then decides. It can express detailed policy without creating a role for every case.
Choosing between them
Think about who decides and what the decision uses.
- Owner decides: DAC.
- System enforces labels and clearances: MAC.
- Job function decides: RBAC.
- Many attributes and context decide: ABAC.
- A fixed condition or schedule decides: rule based or time based.
What to remember for the exam
Seven facts cover most questions on this topic.
- AAA means authentication, authorization and accounting.
- Authentication proves identity, authorization grants rights, and accounting records activity.
- In DAC, the resource owner decides who has access.
- In MAC, the system enforces rules using labels and clearances.
- Role based control grants access according to job function.
- Attribute based control uses attributes of the user, resource and context.
- Time based control limits access to set times.
Look for the decision maker in the scenario. An owner sharing a file is DAC, a clearance label is MAC, and a job title is RBAC.
Common mistakes
These four errors appear often.
Mixing authentication and authorization. Logging in proves identity. What you can then do is authorization.
Forgetting accounting. Accounting is the record of activity, and it supports audit and investigation.
Treating DAC as the most secure model. The owner can share freely, so it is flexible but weaker against mistakes.
Using role based and attribute based as the same thing. Roles use one factor, the job. Attributes can combine many factors.
Rule based access control here means rules set by an administrator. Do not confuse it with role based access control, which has a similar name.
Check yourself
Work through these three questions.
Who decides access in discretionary access control?
The owner of the resource decides who may use it.
How does role based access control differ from attribute based access control?
Role based control uses the job role of the user. Attribute based control can combine several attributes of the user, resource and context.
What are the three parts of AAA?
Authentication, authorization and accounting. They prove identity, grant rights and record activity.
Topic 5 of 8 in Security Concepts
Test yourself on Security Concepts
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.