Identity and Access Management (IAM) · Topic 3 of 4
Authorization Mechanisms
Authorization models for CISSP: discretionary, mandatory, role-based, rule-based, attribute-based and risk-based access control, and access policy enforcement.
- 3 min
- DAC: owner decides. MAC: system labels. RBAC: roles. Rule-based: global rules. ABAC: attributes. Risk-based: adaptive.
- PDP decides; PEP enforces.
- Need to know applies even with clearance.
What it is
Authorization decides what an authenticated identity may do. Different access control models suit different organizations: some let owners decide, some enforce labels set by the system, some use roles, rules, attributes or real-time risk.
How it works
Access control models
| Model | Who decides | How | Fits |
|---|---|---|---|
| Discretionary (DAC) | The resource owner | Owner grants rights, often via ACLs | Flexible environments, file shares |
| Mandatory (MAC) | The system, per policy | Subjects' clearances compared with objects' labels; users cannot change them | Military and highly classified systems |
| Role-based (RBAC) | Administrators define roles | Permissions assigned to roles, users assigned to roles | Organizations with stable job functions |
| Rule-based | Administrators define rules | Global rules apply to everyone (for example firewall rules, time-of-day limits) | Network devices, time or location limits |
| Attribute-based (ABAC) | Policy using attributes | Combines user, resource, action and environment attributes | Fine-grained, dynamic decisions, cloud |
| Risk-based | Policy using real-time risk | Adjusts access or requires step-up authentication based on risk signals | Adaptive access, zero trust |
MAC is "labels and clearances, users cannot change them". DAC is "the owner decides". RBAC is "access follows the job".
Policy enforcement
| Component | Role |
|---|---|
| Policy decision point (PDP) | Evaluates the request against policy and decides |
| Policy enforcement point (PEP) | Enforces the decision (gateway, application, proxy) |
| Policy information point | Supplies attributes |
| Policy administration point | Where policies are written and managed |
Zero trust architectures rely on PDPs and PEPs to decide each request using identity, device and context.
Need to know and least privilege
Even with the right clearance, users should access only what their task requires (need to know). Least privilege limits the rights granted to the minimum.
Common authorization weaknesses
- Privilege creep: rights accumulate as people change roles.
- Excessive standing privileges: admin rights held permanently instead of just in time.
- Role explosion: so many roles that RBAC becomes unmanageable; ABAC can help.
- Inconsistent enforcement: checks done in the client rather than the server.
A worked scenario
An audit finds that 22% of employees still hold permissions from earlier roles. Managers resist removing them because users say they occasionally need the old access. More frequent certifications have not helped. The root fix is a process one: revoke prior-role access at transfer and require justified, approved requests for any exceptions.
How the exam asks about this
- "Users cannot change labels; access compares clearance with classification." MAC.
- "Access depends on job title." RBAC.
- "Access depends on department, device posture and time of day together." ABAC.
What to remember for the exam
- DAC: owner decides. MAC: system labels. RBAC: roles. Rule-based: global rules. ABAC: attributes. Risk-based: adaptive.
- PDP decides; PEP enforces.
- Need to know applies even with clearance.
- Privilege creep is fixed at role change, backed by reviews.
- Enforce authorization on the server, not the client.
Rule-based access control and role-based access control share the abbreviation RBAC. Read the scenario to see whether access follows global rules or job roles.
Common mistakes
Calling MAC user-controlled.
Relying only on periodic reviews to fix privilege creep.
Enforcing permissions in client-side code.
Check yourself
In which model does the data owner grant access at their discretion?
Discretionary access control (DAC).
Which component of an access architecture enforces the decision?
The policy enforcement point (PEP).
Which model evaluates user, resource and environment attributes together?
Attribute-based access control (ABAC).
Topic 3 of 4 in Identity and Access Management (IAM)
Test yourself on Identity and Access Management (IAM)
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.