- \n
- Choosing mandatory access control vs. discretionary access control ultimately depends on your organization’s priorities.<\/li>\n\n\n\n
- MAC is used primarily by government organizations, militaries, and law enforcement, while DAC is a good choice for small businesses with limited IT staff and cybersecurity budgets.<\/li>\n\n\n\n
- The best strategy is to choose a hybrid model, using strict MAC for sensitive data and DAC for less critical resources where flexibility is important.<\/li>\n\n\n\n
- Syteca PAM secures privileged access with just-in-time access provisioning, strong authentication, password management, account discovery, and session monitoring.<\/li>\n<\/ul>\n\n\n\n
Access control models: why are they important?<\/h2>\n\n\n\n
Access control<\/strong><\/a> regulates which users, applications, and devices can view, edit, add, or delete resources within an organization\u2019s environment. Controlling access is one of the key practices for protecting sensitive data from theft, misuse, abuse, and other threats. There are two levels of access control: physical and logical.<\/p>\n\n\n\n
![\"Access](\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/04\/15083133\/1-mac-vs-dac.svg\")
<\/figure>\n\n\n\nAccess control helps mitigate both internal and external threats. That\u2019s why IT regulations, laws, and standards, such as NIST<\/strong><\/a>, HIPAA<\/strong><\/a>, PCI DSS<\/strong><\/a>, and others<\/strong><\/a>, enforce strict physical and logical access controls. In this article, we discuss models of logical access control.<\/p>\n\n\n\n
You can choose from several logical access control models, including mandatory, discretionary, role-based, and attribute-based. Each model has its pros and cons. Later in this article, we\u2019ll review the pros and cons of MAC and DAC. For more on this topic, see our article about the pros and cons of role-based access control and attribute-based access control<\/a> models.<\/p>\n\n\n\n
The process of selecting one of these models differs from organization to organization. The choice of model depends on:<\/p>\n\n\n\n
- \n
- The nature of the protected data<\/li>\n\n\n\n
- IT requirements and industry standards<\/li>\n\n\n\n
- The number of employees<\/li>\n\n\n\n
- The cybersecurity budget<\/li>\n<\/ul>\n\n\n\n
Let\u2019s compare MAC vs. DAC models to better understand the real differences between them.<\/p>\n\n\n\n
Managing Insider Threats with Syteca<\/a><\/p>\n\n\n\n
What is mandatory access control?<\/h2>\n\n\n\n
Mandatory access control<\/strong> (MAC) is a model of access control in which an operating system grants access based on data confidentiality and user clearance levels. In this model, access is granted on a need-to-know<\/a> basis: users must prove their need for information before gaining access.<\/p>\n\n\n\n
MAC is also called a non-discretionary access control model, meaning that access isn\u2019t granted at the discretion of the user or file owner. The MAC model\u2019s control mechanisms enable organizations to implement zero-trust principles<\/a>.<\/p>\n\n\n\n
In comparing DAC vs. MAC, MAC is typically considered the most secure of the two access control models. Access rules in this model are manually defined by system administrators and strictly enforced by the operating system or security kernel. Regular users can\u2019t alter security attributes, even for data they created.<\/p>\n\n\n\n
What are the basic principles of MAC?<\/h3>\n\n\n\n
- \n
- The utmost privacy and confidentiality of the organization\u2019s resources are paramount. No one has default privileges to access or edit someone\u2019s data.<\/li>\n\n\n\n
- Access provisioning is centrally administered.<\/li>\n\n\n\n
- Each individual and resource in the system has security labels with their classification and category.<\/li>\n<\/ol>\n\n\n\n
![\"How](\"https:\/\/syteca_site_uploads.storage.googleapis.com\/wp-content\/uploads\/2023\/04\/15083215\/2-mac-vs-dac.svg\")
<\/figure>\n\n\n\nWith MAC, the process of gaining access looks like this:<\/p>\n\n\n\n
- \n
- The administrator configures access policies and defines security attributes like confidentiality levels and clearances for accessing different projects and resource types.<\/li>\n\n\n\n
- The administrator assigns a set of attributes to each subject (a user or service that accesses data) and object (a file, database, port, etc.).<\/li>\n\n\n\n
- When a subject attempts to access an object, the operating system examines the subject\u2019s security attributes and decides whether access can be granted.<\/li>\n\n\n\n
- To obtain access to the object, the user provides their credentials.<\/li>\n<\/ul>\n\n\n\n
In addition to checking confidentiality and clearance levels (classification matches<\/strong>), operating systems also check category matches<\/strong> between subject and object. Having a \u201ctop secret\u201d clearance doesn\u2019t automatically grant access to a file if the user isn\u2019t part of the required category.<\/p>\n\n\n\n
Let\u2019s take a look at a real-world example of MAC implementation. Suppose an organization possesses data with a \u201ctop secret\u201d confidentiality level and an \u201cengineering project\u201d security label. This data is available only to the set of users with both a \u201ctop secret\u201d security clearance (classification) and<\/em> authorization to access engineering documents (category). These users can also access information that requires a lower level of clearance. At the same time, employees with lower clearance levels or no rights to access engineering documents can\u2019t access such information.<\/p>\n\n\n\n
MAC offers many benefits to cybersecurity systems, but it also has several disadvantages. Let\u2019s look at the advantages and disadvantages of mandatory access control.<\/p>\n\n\n\n\t\t
\n\t\t\t\n\t\t\t\n\nPros and cons of MAC<\/h3>\n\n\n\n\t\t
\n\t\t\t\n\n\t\t\t\n\n\t\t\n\t\t\t\n\t\t\t\n\n\t\t\n\t\t\t\n\t\t\n\t\t\t\n\t\t\t\t\n\t\t\t\t\t\n\t\t\t\n\t <\/div>\n\n\t \n\n\t \n\n\t \n\t \t\t\t<\/div>\n\t \t\t<\/div>\n\t \t<\/div>\n\t <\/div>\n\t\n\t\t\t\n\nPros<\/p>\n\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n\t\t
\n\t\t\t\n\t\t\n\t\t\t\n\t\t\t\t\n\t\t\t\t\t\n\t\t\t\n\t <\/div>\n\n\t \n\n\t \n\n\t \n\t \t\t\t<\/div>\n\t \t\t<\/div>\n\t \t<\/div>\n\t <\/div>\n\t\n\t\t\t\n\n- \n
- High level of data protection<\/strong> \u2014 an administrator defines access to objects, and users can\u2019t alter that access.<\/li>\n\n\n\n
- Granularity<\/strong> \u2014 an administrator sets user access rights and object access parameters manually.<\/li>\n\n\n\n
- Immunity to Trojan Horse attacks<\/strong> \u2014 users can\u2019t declassify data or share access to classified data.<\/li>\n\n\n\n
- Fewer errors<\/strong> \u2014 strict, consistently enforced policies reduce system errors that lead to overprivileged users.<\/li>\n\n\n\n
- Strict division<\/strong> \u2014 admins divide users into subsets and limit resource exposure for these subsets using security attributes.<\/li>\n<\/ul>\n\n\n\t\t\t \n\t\t<\/div>\n\t\n \n\t\t\t\n\t\t<\/div>\n\t\n\n\n\t\t
\n\t\t\t\n\t\t\t\n\n\t\t\n\t\t\t\n\t\t\n\t\t\t\n\t\t\t\t\n\t\t\t\t\t\n\t\t\t\n\t <\/div>\n\n\t \n\n\t \n\n\t \n\t \t\t\t<\/div>\n\t \t\t<\/div>\n\t \t<\/div>\n\t <\/div>\n\t\n\t\t\t\n\nCons<\/p>\n\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n\t\t
\n\t\t\t\n\t\t\n\t\t\t\n\t\t\t\t\n\t\t\t\t\t\n\t\t\t\n\t <\/div>\n\n\t \n\n\t \n\n\t \n\t \t\t\t<\/div>\n\t \t\t<\/div>\n\t \t<\/div>\n\t <\/div>\n\t\n\t\t\t\n\n- \n
- Complex maintenance<\/strong> \u2014 manual configuration of security levels and clearances requires constant administrator oversight.<\/li>\n\n\n\n
- Manual scalability<\/strong> \u2014 MAC doesn\u2019t scale automatically. New users and new data require constant updates to objects and account configurations.<\/li>\n\n\n\n
- Interference with workflow<\/strong> \u2014 users have to request access to each new piece of data; they can\u2019t configure access parameters for their own data.<\/li>\n<\/ul>\n\n\n\t\t\t \n\t\t<\/div>\n\t\n \n\t\t\t\n\t\t<\/div>\n\t\n \n\t\t<\/div>\n\t\n\n\t\t\t \n\t\t<\/div>\n\t\n\n\n
When to use MAC: Real-world use cases<\/h3>\n\n\n\n
This access control model is used mainly by government organizations, militaries, and law enforcement institutions. The US government uses MAC to secure classified information<\/a> and to support multilevel security<\/a> policies and applications. To improve data protection and compliance in the insurance industry<\/a> and the banking sphere<\/a>, organizations use MAC to control access to customer account data. MAC can be used to manage access to databases and their objects, like procedures, tables, and views.<\/p>\n\n\n\n
It\u2019s reasonable to use MAC in organizations that value data security over operational flexibility and cost. Implementing MAC in corporate environments is rare because of its complexity and inflexibility.<\/p>\n\n\n\n
A MAC-only model provides a high level of granular security. On the other hand, it\u2019s difficult to set up and maintain. That\u2019s why it\u2019s common to combine MAC with other access control models.<\/p>\n\n\n\n
- Manual scalability<\/strong> \u2014 MAC doesn\u2019t scale automatically. New users and new data require constant updates to objects and account configurations.<\/li>\n\n\n\n
- Granularity<\/strong> \u2014 an administrator sets user access rights and object access parameters manually.<\/li>\n\n\n\n
- High level of data protection<\/strong> \u2014 an administrator defines access to objects, and users can\u2019t alter that access.<\/li>\n\n\n\n