CSEC3616Cybersecurity Engineering

    Discretionary and mandatory access control

    DAC and MAC as the two ends of a spectrum for who decides access, illustrated with OneDrive personal sharing versus Microsoft 365 admin policy.

    • Define discretionary and mandatory access control and say who holds the decision in each.
    • Place a given access-control scenario correctly on the DAC-MAC spectrum.
    • Explain why DAC alone could not satisfy the US military multilevel security requirement.

    12 min read

    Intuition

    In the earliest computers, whoever had physical access controlled all of it: they could load any software, inspect anything in memory or on disk, and change whatever they wanted. Multi-user systems inherited that model in a softer form. An administrator still starts in supervisor mode and decides which less-privileged accounts to hand out, for tasks like running an app from a company they don’t fully trust, or giving someone else remote logon access. That administrator-decides model is one end of a spectrum. The other end exists because some organisations cannot tolerate any single person, administrator included, being able to override a classification rule.

    Mechanism

    Every object in this picture, a file, a process, anything access control governs, is owned by some subject. Under discretionary access control (DAC), access to an object is decided by the identity of the subject that owns it, and that owner can pass their privileges on to other subjects at their own discretion, unless something else constrains them. DAC is flexible: control sits with whoever owns the resource, and they can grant or revoke it as they see fit.

    Mechanism

    Mandatory access control (MAC) removes that discretion. An external entity, a security policy administrator, defines the access policy, and a security kernel checks a subject’s security attributes against an object’s before allowing any interaction. The owner of an object under MAC does not get the final say. MAC grew out of a US military research program in the 1970s aimed at protecting classified information: a file marked Top Secret must never reach a user cleared only to Secret, regardless of what any ordinary user, or even the supervisor, tries to do. In a multilevel secure (MLS) system built this way, the administrator is no longer the boss. Ultimate control rests with a remote authority that sets policy, and root itself is under that authority’s control.

    Compare

    Access decided by the object’s owner. Owners can transfer their own privileges to other subjects at their own discretion. High flexibility, low central control.

    Access decided by an external security policy administrator and enforced by a security kernel that checks security attributes. No individual subject, not even root, can override the policy. High rigour, low individual discretion.

    Exam detail

    The lecture’s own worked contrast is Microsoft OneDrive. Under DAC, the creator of a file or folder is its owner by default and can transfer that ownership. Files are private unless the owner chooses otherwise: they can share with specific people by email, generate a link for viewing or editing, or make a file fully public, and set the permission level to view or edit. Every one of those choices sits with the individual owner.

    Exam detail

    In Microsoft 365, the enterprise tier of the same product, MAC elements sit on top. Administrators set organisation-wide sharing and access policies, for example restricting sharing to specific domains, and Data Loss Prevention (DLP) rules automatically restrict access to information the policy marks sensitive. Neither of these can be overridden by an individual file owner. OneDrive uses DAC for personal accounts and layers MAC on top for enterprise control, which is exactly why the lecture frames DAC and MAC as two ends of a spectrum rather than an either-or choice.

    Pitfall

    Do not write that MAC gives the system administrator more power than DAC does. MAC does the opposite: it takes the final decision away from the administrator and root, and hands it to an external policy authority enforced by the security kernel. “Mandatory” describes who is bound by the policy, not who benefits from more control.

    Threat

    Under pure DAC, any subject holding a right over an object can pass that right on to another subject at their own discretion, with no central check. A single careless or compromised owner can propagate access far beyond what the resource’s original purpose called for, and nothing in the DAC model itself stops them.

    Control

    MAC closes that gap by removing the owner’s discretion to override policy: a security kernel checks a subject’s security attributes against the object’s before any access is granted, using rules set by an external administrator no single subject, owner included, can bypass. This is precisely why the US military’s classified- information requirement needed MAC rather than a stronger version of DAC: the guarantee has to hold regardless of what any individual user does.

    Recall

    A start-up has no access-control policy beyond letting each employee decide who can see the files they create. Which model is this, and what happens to a file if its creator does nothing?

    This is discretionary access control. If the creator sets no explicit sharing rule, the file is accessible to everyone in the company by default, exactly as the practice-quiz scenario describes for Sam’s start-up.

    Aside

    Bell-LaPadula and Biba, covered later in this module, are the two named security policy models that formalise MAC’s “no override” guarantee into precise rules about what a subject may read and write. This page only introduces the spectrum; the formal properties come with those two models.

    Source

    Week 3 notes PDF