ABAC, or Attribute Based Access Control, is an advanced access control model that grants access based on multiple attributes rather than just roles or ownership. Attributes can include user characteristics, resource type, location, time of day, or device status.
Imagine a smart door that opens only if several conditions are true. The person must be an employee, must be in the building during business hours, and must be using a company issued badge. If any condition is not met, the door stays locked. That is how ABAC works.
In ABAC systems, policies evaluate attributes dynamically. For example, a healthcare system might allow doctors to access patient records only if they are assigned to that patient and are accessing the system from within the hospital network during their shift.
ABAC provides highly flexible and fine grained control. It is commonly used in cloud environments and modern enterprise systems where context matters. However, it can be more complex to design and manage compared to DAC or RBAC.
For Security+, ABAC is important because it represents the evolution of access control toward more dynamic and context aware security models. You must understand how attributes influence access decisions and how ABAC enhances security posture in modern environments.
Related keywords:
- Policy Engine
Context Aware Access
Least Privilege
Access Control Model
Identity and Access Management