What is Authorization and some common types?
Authorization is the process of granting or denying access to certain resources or actions based on the identity and privileges of a user or a group. Authorization is usually done after authentication, which verifies the identity of the user or the group. Authorization helps to enforce security policies and protect data from unauthorized access or modification.
Some common authorization techniques are:
Discretionary Access Control (DAC): This technique allows the owner of a resource to decide who can access or modify it. The owner can create an access control list (ACL) that specifies the users or groups and their permissions. For example, a file owner can grant read or write access to other users or groups. DAC is easy to configure and manage, but it may not be very secure or scalable.
Role-Based Access Control (RBAC): This technique assigns roles to users or groups based on their responsibilities and functions. Each role has a set of permissions that define what resources or actions they can access or perform. For example, an administrator role may have full access to all resources, while a guest role may have limited access to some resources. RBAC is reliable and secure, but it may require more administration and maintenance.
Mandatory Access Control (MAC): This technique uses a centrally managed model to provide the highest level of security. A system administrator defines the security labels for each resource and user or group. The security labels consist of two elements: classification and clearance, which indicate the sensitivity and access level of the resource or user; and compartment, which indicates the group or project that the resource or user belongs to. A user can only access a resource if their security label matches the resource’s security label. For example, a top-secret resource can only be accessed by a user with top-secret clearance and the same compartment. MAC is extremely secure and enforceable, but it may be inflexible and complex.
Attribute-Based Access Control (ABAC): This technique uses attributes to define the access policies and decisions. Attributes are characteristics or properties of a resource, user, action, or environment. For example, an attribute can be the name, role, location, time, or device of a user or a resource. A system administrator defines the rules and conditions that use the attributes to grant or deny access. For example, a rule can state that a user can access a resource only if they have a certain role and are in a certain location and time. ABAC is dynamic and flexible, but it may be difficult to implement and monitor.
I hope you find this post useful and informative. Please feel free to share your feedback in the comments. Stay tuned for more posts on cybersecurity, risk and compliance in the coming days.
