📖 What is Discretionary Access Control (DAC)?
Discretionary Access Control (DAC) is an access control method where the owner of a resource determines who is granted access to that resource. This flexibility allows owners to pass permissions to other users, though it is generally considered less secure than MAC or RBAC.
"Warning: DAC is the most flexible but also the most prone to 'permission creep' because users can grant access to others."
📚 Certification: CCSP (CCSP)
🔑 What are the Key Concepts of Discretionary Access Control (DAC)?
- ▸ Resource Ownership: The creator or owner of an object has total control over its permissions and can grant access to other users at their discretion.
- ▸ Access Control Lists (ACLs): DAC typically implements permissions using ACLs, which map specific user identities to allowed actions like read, write, or execute.
- ▸ Permission Creep: A significant risk where users accumulate excessive privileges over time because owners grant access without a formal process for revocation.
- ▸ Decentralized Administration: Unlike MAC or RBAC, DAC distributes the power of access management to individual users rather than a central security administrator.
- ▸ Flexibility vs. Security: DAC provides the highest level of user flexibility for collaboration but offers the lowest level of security due to lack of centralized control.
🎯 How does Discretionary Access Control (DAC) appear on the CCSP Exam?
You may be asked to identify the access control model in a scenario where a cloud user creates a shared folder and manually assigns permissions to specific team members.
A scenario might describe a security audit finding that users have granted permissions to unauthorized peers; you must identify this as a characteristic weakness of DAC.
Expect questions comparing DAC and MAC in high-security environments, where you must determine why MAC is preferred for preventing unauthorized data leakage and ensuring strict policy enforcement.
❓ Frequently Asked Questions
How does DAC differ from RBAC in a cloud environment?
DAC is based on individual ownership and user discretion, whereas RBAC assigns permissions to roles. In cloud platforms, RBAC is preferred for scalability and centralized management of permissions across large user bases.
Why is DAC considered a risk for sensitive organizational data?
DAC allows users to pass permissions to others without administrative oversight. This decentralized control makes it nearly impossible to enforce a strict 'need-to-know' policy or maintain a consistent security posture.