📖 What is Discretionary Access Control (DAC)?
Discretionary Access Control (DAC) is an access control model where the owner of a resource determines who is granted access and what permissions they have. It is highly flexible but less secure than MAC or RBAC because users can pass permissions to others.
"Be wary of DAC in high-security scenarios. Because the owner controls access, it is the most susceptible to user error and unauthorized permission sharing."
📚 Certification: CompTIA Cybersecurity Analyst+ (CS0-003)
🔑 What are the Key Concepts of Discretionary Access Control (DAC)?
- ▸ Resource Ownership: The creator or owner of an object possesses the authority to determine who is granted access and what specific permissions they hold.
- ▸ Access Control Lists (ACLs): DAC is most commonly implemented via ACLs, which map specific users or groups to allowed actions like read, write, or execute.
- ▸ Permission Delegation: A defining characteristic where owners can pass their access rights to other users, potentially leading to unauthorized permission propagation across the system.
- ▸ Flexibility and Ease of Use: DAC allows for rapid sharing and collaboration without requiring central administrative intervention, making it ideal for low-security, high-collaboration environments.
- ▸ OS Implementation: Most standard operating system file permissions, such as those found in Windows NTFS or Linux, operate on a discretionary access control model.
🎯 How does Discretionary Access Control (DAC) appear on the CS0-003 Exam?
You may be asked to identify the access control model in a scenario where a user is able to change the permissions of a folder they created to allow a colleague access.
A scenario might describe a security audit finding 'permission creep,' where users have accumulated excessive rights because file owners granted access haphazardly; you must identify this as a DAC weakness.
Expect questions comparing DAC to MAC, where you must explain why DAC is inappropriate for multi-level security environments requiring strict, non-discretionary labels and mandatory policies.
❓ Frequently Asked Questions
How does DAC differ from RBAC in a corporate environment?
DAC relies on the owner's discretion for individual files, whereas RBAC assigns permissions to predefined roles. RBAC provides centralized control and consistency, preventing the security gaps common in owner-managed DAC systems.
Can DAC be used in conjunction with other models?
Yes, many systems use a hybrid approach. For example, an organization might use RBAC for application-level access but rely on DAC for individual user folders within a shared network drive.