So I've been reading up on MAC vs DAC vs RBAC and there is something which I do not understand. Everywhere you read, it tells you that these types are different (disjoint) but isn't RBAC just a type (implementation) of MAC?

From what I gather, MAC is a generic control policy in which the administrator manages all access rights. In RBAC, rights are assigned to roles but ultimately roles are still managed by the administrator right? The admin decides which user has which role and he is also the one which can change permission for all roles so ultimately the administrator is still the one managing all access rights, correct?

Also I've watched this video on YouTube Implementing MAC Example, and this model worked as such: data was classified into categories according to its sensitivity (i.e. top secret, secret, confidential etc) and the company was divided into departments. The account control was implemented as a set of labels L = (sensitivity level, department) which meant that users from that department have rights on files of that sensitivity level. Very basic example, I know, but I don't understand how this is different from RBAC. The department of a user is basically his role and the labels show what rights each of the departments has. Honestly if I were to be asked "what type of account control was presented in the video" I would answer RBAC but the video claims it presents MAC.

Can someone shed some light on precisely what differs between the two and why one isn't just a subcategory of the other?

Thanks in advance.

  • Welcome to Security Stack Exchange. I'm sure someone here will be able to clarify the difference. – Bryan Field Jan 29 '17 at 21:25
  • The difference is in the level of granularity <-> administrative complexity. – Jacco Jan 29 '17 at 21:27
  • @Jacco, could you please be a little more specific? i.e. for the example I have provided, how can I tell it is MAC and not RBAC? – Nu Nunu Jan 29 '17 at 21:59

Think of the two models as accomplishing similar objectives, but through a different perspective. What's even more confusing is that in practice they may be combined.

Think of MAC like a simplified version of the US Government classification system -- you have Confidential, Secret, Top Secret for example. If one only has a Confidential clearance, they may not access secret or top secret, but when one has a Top Secret clearance they may receive access to documents on all levels. One key element of MAC though is that it's handled centrally and enforced by the computer system -- so users, sysadmins etc cannot escalate privileges on their own without approval by the central authority of the organization.

In contrast, a role-based access control would be more granular. For example, if using role-based access control, someone working for the US Government in Human Relations would have access to memos, dossiers and other information on employees as their position requires. However, they wouldn't have access to other information at the same classification level that is outside of their scope of work -- like, financials for equipment purchases. So, role-based access control limits the scope of information.

The systems can be combined in practice, and many systems may have a combination of role-based and mandatory-access controls. However, RBAC is seen as usually more suited for commercial environments while MAC is more associated with sensitive environments such as defense.

That said, in terms of the video you identify, the question is tricky. However, the fact it contains both sensitivity level and department means it's RBAC -- as department is involved (that's a role). Because sensitivity level is involved, then it's not DAC (discretionary access control) but rather MAC being implemented in an RBAC fashion.

Your Answer

