Access control

The main objective of the access control process is to ensure that only authorized users are granted access. To achieve this, it is very important for user activities to be uniquely identifiable for accountability purposes. The security manager should also consider the following categories of access control.

Mandatory access control

In mandatory access control (MAC), control rules are governed by an approved policy. Users or data owners cannot modify the access role. MAC ensures that files are shared only with authorized users as per the security classification of the file. This will ensure that users cannot share the file with unauthorized users.

Discretionary access control

In discretionary access control (DAC), access control can be activated or modified by the data owner at their discretion.

MAC is considered to be more robust and stringent in terms of information security compared to DAC. To increase the effectiveness of DAC, it should be aligned...