📖 What is Discretionary Access Control (DAC)?
Discretionary Access Control (DAC) is an access control model where the owner of a resource determines who is granted access to that resource. It allows users to pass permissions to others at their own discretion, offering high flexibility but lower security.
"DAC is the default for most standard operating systems. Warning: it is the most vulnerable to Trojan horses because a malicious program can inherit the owner's permissions."
📚 Certification: CompTIA Advanced Security Practitioner+ (CAS-004)
🔑 What are the Key Concepts of Discretionary Access Control (DAC)?
- ▸ Resource Ownership: The identity that creates a file or object is designated as the owner, granting them total control over access permissions for that resource.
- ▸ Permission Delegation: Owners can grant read, write, or execute permissions to other users or groups at their own discretion, allowing for rapid collaboration.
- ▸ Access Control Lists (ACLs): DAC is typically implemented using ACLs, which list specific users or groups and the operations they are permitted to perform.
- ▸ Inheritance Risks: Because permissions are tied to the user's identity, any application run by that user inherits their full access rights, increasing malware risk.
- ▸ Administrative Flexibility: DAC provides the highest level of user autonomy, making it ideal for general-purpose operating systems but unsuitable for high-security environments.
🎯 How does Discretionary Access Control (DAC) appear on the CAS-004 Exam?
You may be asked to identify the access control model in a scenario where a user is able to share a folder with a colleague without administrator approval.
A scenario might describe a system compromised by a Trojan horse that gained full access to the user's files; you must identify DAC as the underlying vulnerability.
Expect questions asking you to contrast DAC with MAC when designing a secure environment for classified government data where strict, non-discretionary policies are required.
❓ Frequently Asked Questions
Why is DAC considered less secure than Mandatory Access Control (MAC)?
DAC allows users to change permissions, which can lead to accidental over-provisioning. MAC removes this discretion, enforcing a central policy based on security labels that users cannot modify.
How does the 'Trojan Horse' vulnerability specifically apply to DAC?
In DAC, a malicious program runs with the same permissions as the user who executed it. If the user owns sensitive files, the malware can modify or steal them.
Can DAC and RBAC be used together in an enterprise?
Yes. Many systems use RBAC for broad organizational permissions while allowing DAC for individual file sharing, though this hybrid approach requires careful auditing to prevent permission creep.