Rule-Based Access Control
Summary
PDF p.94Rule-based access control (RBAC) models determine access control policies through system-enforced rules rather than user discretion. Examples include Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and Mandatory Access Control (MAC). Conditional access is a specific type of rule-based control that monitors behavior and enforces additional authentication when certain conditions are met.
In plain words
Supplementary — not from your PDFRule-based access control means system-wide rules decide access, not users. Conditional access watches a session and adds checks, such as asking for MFA again or a UAC or sudo prompt, when something risky happens.
Detailed explanation
PDF p.94-
Rule-Based Access Control
- Definition: Access control policies are determined by system-enforced rules, not by users.
- Examples: Includes RBAC, ABAC, and MAC.
-
Conditional Access
- Definition: Monitors account or device behavior throughout a session and enforces additional authentication or suspends the account if certain conditions are met.
- Examples: User Account Control (UAC) and sudo restrictions on privileged accounts.
- Function: Prompts for confirmation or authentication when elevated privileges are required.
- Criteria: Can include location-based policies and other criteria applied by RBAC and ABAC systems.
Important terms
taken from the text above- Rule-Based Access Control
- Access control policies are determined by system-enforced rules, not by users.
- Conditional Access
- Monitors account or device behavior throughout a session and enforces additional authentication or suspends the account if certain conditions are met.
- Criteria
- Can include location-based policies and other criteria applied by RBAC and ABAC systems.
Examples & real-world scenarios
Supplementary — not from your PDF- UAC prompting before installing software.
- Requiring MFA again for a sign-in from a new country.
- sudo asking for a password before an admin command.
Scenario
A user signs in normally in the morning, then an hour later from another continent. Conditional access flags it as risky and requires reauthentication.
Common mistakes
Supplementary — not from your PDF- Confusing rule-based access control with role-based. Both abbreviate to RBAC, so read the context.
- Thinking conditional access only happens at login. It can act during the session.
Practical skills
Supplementary — not from your PDF- Write a conditional access rule in plain English.
What I should remember
Key Points PDF p.94-
Rule-Based Access Control
- System-Enforced: Policies determined by rules, not users.
- Examples: RBAC, ABAC, MAC.
-
Conditional Access
- Monitoring: Tracks behavior during sessions.
- Actions: Suspends account or requires reauthentication if conditions are met.
- Examples: UAC, sudo restrictions.
- Criteria: Includes location-based policies and other criteria.