Access Control Models

Compare and contrast access control models. Select an access control model that best prevents unauthorized access for each of the five scenarios given below. Which types of logical access controls should be used in each scenario? Justify your recommendations.

Access control models:
Mandatory access controls
Discretionary access controls
Role-based access controls
Rule-based access controls
Content-dependent access controls
Nondiscretionary access controls

Scenarios:
1. Shovels and Shingles is a small construction company consisting of 12 computers that have Internet access. a. (DAC) Discretionary Access Control. Being that the business is small and not in need of higher security measures, it would be the easiest to maintain and monitor for a small business.

2. Top Ads is a small advertising company consisting of 12 computers that have Internet access. All employees communicate using smartphones. a. (MAC) Mandatory Access Control. The employees primarily communicate using smartphones; which proves as a possible security risk. MAC is stronger than DAC but, still easily monitored for a small business; which makes this the top choice for Top Ads.

3. NetSecIT is a multinational IT services company consisting of 120,000 computers that have Internet access and 45,000 servers. All employees communicate using smartphones and e-mail. Many employees work from home and travel extensively. a. (RBAC) Role Based Access Control. With the company being as large as it is and the employees traveling and/or working from home, the roles set by a Security Administrator would be the most secure and efficient way of providing different levels of clearance to individual users. It would take time to start from nothing but, once the security measures are in place it would be easy to monitor and to manage.

4. Backordered Parts is a defense contractor that builds communications parts for the military. All employees communicate using smartphones and e-mail. a. Content-Dependent Access Control. Since everything that the company does depends on the individual material being manufactured the above Access Control type should be apparent. Giving permissions by what is contained in each individual file is more costly but, a lot more secure. It also allows the company to monitor the data sent less as each document is given its own set of roles.

5. Confidential Services Inc. is a military-support branch consisting of 14,000,000 computers with Internet access and 250,000 servers. All employees must have security clearances, and they communicate mainly using BlackBerry devices and e-mail. a. (RBAC) Role Based Access Control. With RBAC in place the security measures would be assigned to each user and monitored by the security administrator(s). Using this Access control method would allow for high-grade security with manageability in mind. Allowing each user a set of permissions dependent on their group, or role, allows the system admin to more easily monitor security by group; which is perfect for a military network.