Security Operations · Topic 10 of 13
Access Control Models and Authentication
Security+ access control models MAC, DAC, RBAC and ABAC, plus authentication factors, MFA, password practice and privileged access management (PAM).
- 4 min
- MAC uses system enforced labels, DAC lets owners decide, RBAC uses roles and ABAC uses attributes.
- Rule based access follows set rules, and RBAC follows roles. Do not mix them up.
- Least privilege gives the minimum rights required.
What it is
Access control decides what an authenticated user may do. Authentication proves who the user is. Both must be strong, and the most powerful accounts need extra care.
This page covers the access control models, authentication factors, password practice and privileged access management.
How it works
Access control models
| Model | How access is decided |
|---|---|
| Mandatory access control (MAC) | The system enforces labels, such as clearance and classification, and users cannot change them |
| Discretionary access control (DAC) | The owner of a resource decides who gets access |
| Role based access control (RBAC) | Access follows the user's job role |
| Rule based access control | Access follows fixed rules, such as time or network address conditions |
| Attribute based access control (ABAC) | Access is decided from attributes of the user, resource and context |
| Time of day restrictions | Access allowed only in set hours |
| Least privilege | Give only the rights needed for the task |
MAC is strict and used in high security settings. DAC is flexible but easy to misuse.
RBAC is the usual enterprise choice, because access is managed by role instead of by person. ABAC is more flexible and can include factors such as location or device health.
Authentication factors
| Factor | Examples |
|---|---|
| Something you know | Password, personal identification number (PIN) |
| Something you have | Hardware token, authenticator app, smart card, security key |
| Something you are | Fingerprint, face, iris |
| Somewhere you are | Location or network |
| Something you do | Behavior pattern, such as typing rhythm or gesture |
Multifactor authentication (MFA) combines factors from at least two different categories. Two passwords are not MFA, because both are something you know. Biometrics can be fooled in some cases and cannot be changed if stolen, so they are often paired with another factor.
Hardware tokens and security keys resist phishing better than codes sent by text. Soft tokens are authenticator apps on a device.
Password practice
Strong passwords are long and unique. Password managers help people use a different password for each site.
Controls include length, complexity, reuse limits, expiration and lockout. Current National Institute of Standards and Technology (NIST) guidance favors length and checks against known breached passwords over frequent forced changes, but expiration remains a listed control.
Passwordless authentication replaces passwords with options such as security keys, biometrics on a device or certificates.
Password age has two limits. Maximum age is how long a password may be kept before the system forces a change, which is the expiration control. Minimum age is how long a user must wait before changing it again.
Minimum age works with password history: without it, a user forced to change a password could change it several times in a row and return to the old one, defeating the history rule.
Privileged access management
Privileged access management (PAM) controls accounts with powerful rights, such as administrators.
| Feature | Purpose |
|---|---|
| Just in time permissions | Grant elevated rights only for the time needed |
| Password vaulting | Store and rotate privileged credentials in a protected vault |
| Temporary or ephemeral credentials | Short lived accounts or secrets that expire on their own |
PAM also records privileged sessions, which supports accountability and investigation.
What to remember for the exam
- MAC uses system enforced labels, DAC lets owners decide, RBAC uses roles and ABAC uses attributes.
- Rule based access follows set rules, and RBAC follows roles. Do not mix them up.
- Least privilege gives the minimum rights required.
- MFA needs factors from different categories.
- Hardware security keys are more phishing resistant than text message codes.
- Password managers support unique passwords for each service.
- PAM uses vaulting, just in time access and session recording for powerful accounts.
- Passwordless methods use keys, biometrics or certificates.
If a question describes labels like "secret" and "top secret" set by the system, it is mandatory access control.
Common mistakes
Treating two passwords as MFA. Both are the same factor, so it is still single factor.
Confusing RBAC with rule based access control. Both abbreviate similarly, but one uses roles and the other uses conditions.
Believing biometrics are a perfect factor. They can be spoofed, and a leaked biometric cannot be replaced.
Keeping standing admin rights. Always on privileged access gives attackers a bigger prize.
Trusting text message codes as the strongest option. They can be intercepted or redirected through subscriber identity module (SIM) swap attacks.
Shared administrator accounts break accountability. Use named accounts and a PAM tool so every action is tied to a person.
Check yourself
Which access control model lets the resource owner decide who gets access?
Discretionary access control (DAC).
Why is a password plus a PIN not multifactor authentication?
Both are something you know, so they are the same factor category.
What does just in time access do?
It grants elevated permissions only for the time they are needed, then removes them.
Topic 10 of 13 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.