DrillUnit 5 · Topic 5.2
Access model drill: which model is in use?
Match each organization to the access control model it uses.
New to this? Read the topic first: 5.2 Protecting Applications and Data.
Simulation · [5.2.C.2, 5.2.C.3, 5.2.C.4, 5.2.C.5, 5.2.C.6]
Access model drill: which model is in use?
Each organization below decides who (subjects) can do what (operations) to which files or applications (objects). Pick the access control model it is using.
-
At a hospital, everyone assigned the role "pharmacist" can update the medication stock system; no other role can.
Show the answer
Role-based access control (RBAC). Subjects get access through the role they are assigned, not individually.
-
A student creates a slideshow and gives her whole project group edit access. A week later she removes edit access from one teammate who keeps deleting slides.
Show the answer
Discretionary access control (DAC). The owner of the object decides, and changes, what access other subjects have.
-
A defense agency labels analysts and documents as Confidential, Secret or Top Secret. An external administrator assigns the labels, and a Secret analyst cannot read Top Secret files.
Show the answer
Mandatory access control (MAC). Strict rules by level, set by an external administrator. This is Bell-LaPadula: no read up.
-
A delivery app normally shows drivers a customer's phone number, but a rule hides it as soon as the delivery is marked complete.
Show the answer
Rule-based access control (RuBAC). A rule is checked before access is allowed, and it can deny access the driver would otherwise have. RuBAC is usually layered on top of another model.
-
An app store lets any developer decide which teammates can publish new versions of the apps that developer created.
Show the answer
Discretionary access control (DAC). Owners set access to the objects they own.
Go to the topic: 5.2 Protecting Applications and Data