Which access control concept determines the usage and access policies for users, often applied to highly confidential data?

Which access control concept determines the usage and access policies for users, often applied to highly confidential data?

• A. Mandatory Access Control
• B. Discretionary Access Control
• C. Rule-based Access Control
• D. Role-Based Access Control

Answer: (A)

Access is controlled by system-enforced rules based on labels that determine who can do what, regardless of who owns the data. In this model, each subject (like a user or process) and each object (like a file or database) gets a security label that encodes its level of sensitivity and the user’s clearance. The policy is fixed by administrators, and access decisions are made by comparing the subject’s clearance with the object's classification. Users cannot change these permissions on their own, which keeps the most sensitive information protected even from insiders who might own the data. This tight, centralized control is why it’s favored for highly confidential data, such as government or military information. Discretionary access control relies on the data owner to grant permissions, which can lead to leakage or broader access. Rule-based access control uses system-wide rules that can apply to many objects but doesn’t hinge on fixed classifications for each subject-object pair in the same way as mandatory labeling. Role-based access control assigns permissions by user roles, which is practical for organizations, but it’s driven by roles rather than immutable labels and mandatory policies for sensitive data.

Access is controlled by system-enforced rules based on labels that determine who can do what, regardless of who owns the data. In this model, each subject (like a user or process) and each object (like a file or database) gets a security label that encodes its level of sensitivity and the user’s clearance. The policy is fixed by administrators, and access decisions are made by comparing the subject’s clearance with the object's classification. Users cannot change these permissions on their own, which keeps the most sensitive information protected even from insiders who might own the data. This tight, centralized control is why it’s favored for highly confidential data, such as government or military information.

Discretionary access control relies on the data owner to grant permissions, which can lead to leakage or broader access. Rule-based access control uses system-wide rules that can apply to many objects but doesn’t hinge on fixed classifications for each subject-object pair in the same way as mandatory labeling. Role-based access control assigns permissions by user roles, which is practical for organizations, but it’s driven by roles rather than immutable labels and mandatory policies for sensitive data.