Rule Atlas
NIST SP 800-53: Access Control Models for CISSP
Under NIST SP 800-53 ((ISC)² CBK / NIST SP 800-53), access Control Models for CISSP establishes the authoritative rules tested on the (ISC)² CISSP. Explores Discretionary, Mandatory, Role-Based, Attribute-Based, Rule-Based, and Risk-Based Access Control models, their principles, and practical application in securing information systems. VoraPrep verifies every threshold, worked table, and practice question below against the current (ISC)² CISSP blueprint.
Core Statutory Concepts
| Feature | DAC | MAC | RBAC | ABAC | Rule-Based | Risk-Based |
|---|---|---|---|---|---|---|
| Control Focus | Owner/User | System Admin | Roles/Job Functions | Attributes | Predefined Rules | Dynamic Risk Score |
| Flexibility | High | Low | Medium-High | Very High | Medium | High |
| Complexity | Low-Medium | High | Medium | High | Medium | High |
| Principle of Least Privilege | Difficult to enforce | Inherently strong | Easy to enforce | Highly adaptable | Dependent on rules | Adaptive enforcement |
| Primary Use Case | Small organizations, personal data | High-security environments (military, classified) | Enterprise applications, large user bases | Dynamic, cloud, granular control needs | Network firewalls, basic system policies | Adaptive authentication, zero trust |
| Management | Decentralized | Centralized | Centralized | Decentralized logic, centralized policy | Centralized | Centralized risk engine |
A government research facility handles highly sensitive projects, requiring that access to information be strictly determined by security clearances and data classification labels, overriding any individual user's discretion. Users cannot grant or deny access to files they create. Which access control model is best suited for enforcing this 'need-to-know' policy?
Practitioner Application: Access Control Models for CISSP
A prominent healthcare organization is launching a new research initiative involving highly sensitive patient genetic data. The existing access control system is primarily Discretionary Access Control (DAC), which allows data owners to define permissions. However, the CISO is concerned this model is insufficient for the strict regulatory compliance (e.g., HIPAA) and the need to protect intellectual property from insider threats. The team must select an access control model, or combination, that ensures data confidentiality and integrity while balancing operational efficiency and strict adherence to the principle of least privilege. What access control models should be considered, and how can they be implemented effectively?
- Access control models are foundational to information security, dictating how subjects (users, processes) interact with objects (files, databases, devices). The (ISC)² CBK (2024) emphasizes understanding the fundamental differences and appropriate application of each model to secure organizational assets effectively.
- Discretionary Access Control (DAC) DAC is an access control model where the owner of a resource or an administrator can grant or revoke access to any other user. This model is highly flexible but can be difficult to manage in large environments and is prone to errors, as control is decentralized. Permissions are often stored in Access Control Lists (ACLs) or file system permissions.
Common (ISC)² CISSP Distractors on NIST SP 800-53
- 1Confusing MAC and RBAC: Test questions often present scenarios where a rigid, classification-based system is needed and offer RBAC as a distractor. Remember, MAC enforces security labels and clearances, while RBAC groups permissions by job function.
- 2Overestimating DAC's Enterprise Utility: While flexible, DAC is rarely the best choice for large organizations or highly sensitive data due to its decentralized control and difficulty in enforcing least privilege consistently.
- 3Ignoring Administrative Overhead: A highly secure model might be too complex or costly to administer for a given organization's resources. The CISSP exam often tests practical application and the 'best fit' rather than just the 'most secure' in a vacuum.
- 4Misapplying ABAC: While powerful, ABAC's complexity means it's best for scenarios requiring extremely granular, dynamic, and context-aware access, not as a default for simpler access needs where RBAC would suffice.
- 5DAC (Discretionary Access Control): Owner-controlled, flexible, common in simpler systems; difficult to scale securely.
Frequently Asked Questions: NIST SP 800-53
What is the core rule under NIST SP 800-53 (Access Control Models for CISSP)?
Under NIST SP 800-53 ((ISC)² CBK / NIST SP 800-53), access Control Models for CISSP establishes the authoritative rules tested on the (ISC)² CISSP. Explores Discretionary, Mandatory, Role-Based, Attribute-Based, Rule-Based, and Risk-Based Access Control models, their principles, and practical application in securing information systems. VoraPrep verifies every threshold, worked table, and practice question below against the current (ISC)² CISSP blueprint.
How is NIST SP 800-53 tested on the (ISC)² CISSP?
Confusing MAC and RBAC: Test questions often present scenarios where a rigid, classification-based system is needed and offer RBAC as a distractor. Remember, MAC enforces security labels and clearances, while RBAC groups permissions by job function. Overestimating DAC's Enterprise Utility: While flexible, DAC is rarely the best choice for large organizations or highly sensitive data due to its decentralized control and difficulty in enforcing least privilege consistently.
Where can I practice (ISC)² CISSP questions on Access Control Models for CISSP?
Test yourself instantly with the free playable (ISC)² CISSP question on this page, or launch VoraPrep's full (ISC)² CISSP adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/cissp.