Access Control Models

Four models, and exam questions separate them by one question: who decides who gets in. The authentication factor tables underneath are the other half, because multifactor questions turn on whether two factors are actually different types.

The models

ModelWho decidesTypical use
DACThe data ownerFile shares, most operating systems
MACThe system, from labelsMilitary and classified environments
RBACAssignment to a roleEnterprise directories, most business apps
ABACPolicy over attributesCloud, context-aware access
Rule-basedStatic rules on the resourceFirewall and ACL entries
Least privilegeNot a model, a principleApplies inside every model above

Authentication factors

FactorMeaningExamples
Something you knowKnowledgePassword, PIN, security question
Something you havePossessionToken, smart card, phone with an authenticator
Something you areInherenceFingerprint, face, iris, voice
Somewhere you areLocationGPS, IP geolocation, network segment
Something you doBehaviourTyping rhythm, gait, signature dynamics

Multifactor: what counts

CombinationIs it MFAWhy
Password plus PINNoBoth are knowledge
Password plus TOTP appYesKnowledge plus possession
Password plus SMS codeYes, weaklyPossession, but SIM swapping applies
Smart card plus PINYesPossession plus knowledge
Fingerprint plus faceNoBoth are inherence
Password plus security questionNoBoth are knowledge

AAA and biometric measures

TermWhat it means
AuthenticationProving who you are
AuthorizationWhat you may do once proven
AccountingRecording what you did
RADIUSAAA protocol, UDP, encrypts the password only
TACACS+AAA protocol, TCP, encrypts the whole payload, separates the three A's
KerberosTicket-based authentication, port 88, time sensitive
False acceptance rate (FAR)Wrong person accepted. The security risk
False rejection rate (FRR)Right person rejected. The usability cost
Crossover error rate (CER)Where FAR and FRR meet. Lower is a better system

Now test yourself

Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.