As the title of this posting probably tells you, there are a LOT of acronyms out there talking about access control. To level the set, here are a few translations:
ACL: Access Control List
This is your basic gatekeeper. ACL has a list of users and a simple yes/no function, like a doorman at an exclusive club — “Nope, your name isn’t on the list, you can’t come in.” But once you’re in, you’re in and can do anything.
RBAC: Role-Based Access Control
Obviously, we need more granular control than ACL, so we started implementing role-based access control. Person X has certain role granted to them like “User” and/or “Admin” — these roles are then used to inform systems of what that person is allowed to do. Now the doorman lets you in, but you have to have the pink wristband to get into the bar and a yellow wristband to get into the card game in the back.
ABAC: Attribute-Based Access Control
As the word “attribute” implies, ABAC has an extra wrinkle of additional, contextual rules. You and I may both have a pink wristband, but you’re not 21. So I can get into the bar because of some specific attribute about me, and you’re prohibited because of some specific attribute about you.
Alternatively, we also use the term PBAC, or policy-based access control. The only real difference between ABAC and PBAC is that ABAC has some XML standards to inform the policies. Now, think of it this way: you have the pink wristband, you’re of age, but you only have a state ID, and we really only know how to read passports — the rule enforcement is the same, but ABAC is a bit more technically restrictive.
And then there’s CBAC, which is just Microsoft’s standard. The idea behind it is still attributes informing access.
RAdAC: Risk Adaptive-Based Access Control
Now, we come to the most complex and most powerful collection of “things we know.” RAdAC looks at who you are, what you’re allowed to do, if you have the other requirements to allow you to do it, and, most importantly, if there are any other things going on in the world that might prevent you from doing it.
Say we are trying to keep our nightclub healthy. We get a list of countries that have outbreaks of Spanish flu. (Stick with me here…) A person who visited one of those countries may have been exposed to the flu, and therefore has a higher risk of making our other customers sick.
So, if we break it down:
- ACL: Your name is on the list.
- RBAC: You have a pink wristband.
- ABAC: You’re the right age.
- RAdAC: You haven’t been to a country with Spanish Flu.
Of course, Cloudentity has tools to manage policies that can account for all these static and dynamic variables, regardless of what you want to call the type of policy. But no matter how you manage your policies, or what you call the different kinds of controls, dynamic policy application is how you keep your systems secure in a world of dynamic attacks.