MAC, DAC, and RBAC: Comparing Access Control Models
This paper examines three foundational access control models used in information security: Mandatory Access Control (MAC), Discretionary Access Control (DAC), and Role-Based Access Control (RBAC). It outlines the core elements and operating principles of each model, then evaluates their respective advantages and disadvantages. The paper proposes mitigation strategies for the weaknesses inherent in each approach and argues that MAC is the most appropriate method when confidentiality, least-privilege access, and separation of duties are organizational priorities. Finally, it identifies the practical challenges organizations face when deploying each model, noting that budget, administrative expertise, and organizational structure all influence which model is most suitable.
- Introduction: Defines access control and its main types
- Elements of Access Control: Explains MAC, DAC, and RBAC models
- Positive and Negative Aspects of Each Access Control: Pros and cons of each access control model
- Mitigating the Negative Aspects of Each Access Control Type: Strategies to reduce weaknesses of each model
- Deploying the Most Optimum Access Control Method: Argues MAC is best for confidentiality-focused needs
- Challenges to Deploying Each Type of Access Control Method: Practical barriers to implementing MAC, DAC, RBAC
✍️ How to write this paper — guide, tools & examples ▾
What makes this paper effective
- The paper follows a clear, parallel structure—introducing each model, comparing their pros and cons, proposing mitigations, and then arguing for an optimal deployment choice—making it easy to follow and compare across models.
- It moves logically from description to evaluation to recommendation, demonstrating applied analytical thinking rather than pure summary.
- The final two sections add practical value by addressing real-world deployment challenges and budget considerations, grounding the theoretical comparison in organizational context.
Key academic technique demonstrated
The paper demonstrates comparative analysis: each access control model is evaluated against the same criteria (advantages, disadvantages, mitigation, deployment challenges), allowing the reader to assess trade-offs systematically. This technique is especially useful in applied computing and security courses where students must justify technology choices based on organizational requirements.
Structure breakdown
The paper opens with a brief definitional introduction covering logical and physical access control. It then defines MAC, DAC, and RBAC in a dedicated elements section. Subsequent sections evaluate pros and cons, propose mitigations, argue for MAC as the optimal model under confidentiality-focused requirements, and close by cataloguing deployment challenges for each model. References follow APA format throughout.
Introduction
In the field of information security, access control refers to the selective restriction of access to a resource. It is a security technique used to regulate who or what can use or view a resource within a computing environment. There are two main types of access controls: logical and physical. Physical access control limits physical access to buildings and IT assets, while logical access control limits connections to computer networks, data, and system files (Younis, Kifayat, & Merabti, 2014). Access control systems are responsible for performing identification, authorization, authentication, approval, access, and accountability of entities using login credentials. This paper discusses three main types of access control: Mandatory Access Control (MAC), Discretionary Access Control (DAC), and Role-Based Access Control (RBAC).
Elements of Access Control
Mandatory Access Control (MAC) is a security strategy in which only the administrator has the ability to determine access control. Resource owners are restricted in their ability to deny or grant access to resource objects within a file system (Younis et al., 2014). MAC criteria are strictly enforced by the operating system and cannot be altered by end users. Discretionary Access Control (DAC) is a security strategy in which the owner of a file or object determines which subjects or individuals may access that object (Choi, Choi, & Kim, 2014). This strategy is referred to as discretionary because access control is determined at the discretion of the owner. Role-Based Access Control (RBAC) is an access control strategy based on the roles of individual users within an enterprise. Roles are typically defined according to authority, job competency, and responsibility within the organization.
References
Choi, C., Choi, J., & Kim, P. (2014). Ontology-based access control model for security policy reasoning in cloud computing. The Journal of Supercomputing, 67(3), 711–722.
Fadhel, A. B., Bianculli, D., & Briand, L. (2015). A comprehensive modeling framework for role-based access control policies. Journal of Systems and Software, 107, 110–126.
Kerr, L., & Alves-Foss, J. (2016). Combining mandatory and attribute-based access control. Paper presented at the System Sciences (HICSS), 2016 49th Hawaii International Conference on.
Younis, Y. A., Kifayat, K., & Merabti, M. (2014). An access control model for cloud computing. Journal of Information Security and Applications, 19(1), 45–60.
Create your account
Always verify citation format against your institution’s current style guide requirements.