MAC, DAC, and RBAC: Comparing Access Control Models
This paper examines three foundational access control models used in information security: Mandatory Access Control (MAC), Discretionary Access Control (DAC), and Role-Based Access Control (RBAC). It outlines the core elements and operating principles of each model, then evaluates their respective advantages and disadvantages. The paper proposes mitigation strategies for the weaknesses inherent in each approach and argues that MAC is the most appropriate method when confidentiality, least-privilege access, and separation of duties are organizational priorities. Finally, it identifies the practical challenges organizations face when deploying each model, noting that budget, administrative expertise, and organizational structure all influence which model is most suitable.
- Introduction: Defines access control and its main types
- Elements of Access Control: Explains MAC, DAC, and RBAC models
- Positive and Negative Aspects of Each Access Control: Pros and cons of each access control model
- Mitigating the Negative Aspects of Each Access Control Type: Strategies to reduce weaknesses of each model
- Deploying the Most Optimum Access Control Method: Argues MAC is best for confidentiality-focused needs
- Challenges to Deploying Each Type of Access Control Method: Practical barriers to implementing MAC, DAC, RBAC
✍️ How to write this paper — guide, tools & examples ▾
What makes this paper effective
- The paper follows a clear, parallel structure—introducing each model, comparing their pros and cons, proposing mitigations, and then arguing for an optimal deployment choice—making it easy to follow and compare across models.
- It moves logically from description to evaluation to recommendation, demonstrating applied analytical thinking rather than pure summary.
- The final two sections add practical value by addressing real-world deployment challenges and budget considerations, grounding the theoretical comparison in organizational context.
Key academic technique demonstrated
The paper demonstrates comparative analysis: each access control model is evaluated against the same criteria (advantages, disadvantages, mitigation, deployment challenges), allowing the reader to assess trade-offs systematically. This technique is especially useful in applied computing and security courses where students must justify technology choices based on organizational requirements.
Structure breakdown
The paper opens with a brief definitional introduction covering logical and physical access control. It then defines MAC, DAC, and RBAC in a dedicated elements section. Subsequent sections evaluate pros and cons, propose mitigations, argue for MAC as the optimal model under confidentiality-focused requirements, and close by cataloguing deployment challenges for each model. References follow APA format throughout.
Introduction
In the field of information security, access control refers to the selective restriction of access to a resource. It is a security technique used to regulate who or what can use or view a resource within a computing environment. There are two main types of access controls: logical and physical. Physical access control limits physical access to buildings and IT assets, while logical access control limits connections to computer networks, data, and system files (Younis, Kifayat, & Merabti, 2014). Access control systems are responsible for performing identification, authorization, authentication, approval, access, and accountability of entities using login credentials. This paper discusses three main types of access control: Mandatory Access Control (MAC), Discretionary Access Control (DAC), and Role-Based Access Control (RBAC).
Elements of Access Control
Mandatory Access Control (MAC) is a security strategy in which only the administrator has the ability to determine access control. Resource owners are restricted in their ability to deny or grant access to resource objects within a file system (Younis et al., 2014). MAC criteria are strictly enforced by the operating system and cannot be altered by end users. Discretionary Access Control (DAC) is a security strategy in which the owner of a file or object determines which subjects or individuals may access that object (Choi, Choi, & Kim, 2014). This strategy is referred to as discretionary because access control is determined at the discretion of the owner. Role-Based Access Control (RBAC) is an access control strategy based on the roles of individual users within an enterprise. Roles are typically defined according to authority, job competency, and responsibility within the organization.
Positive and Negative Aspects of Each Access Control
The primary advantage of MAC is that it provides tighter security, since only the system administrator is able to access and alter the specified controls. This ensures that only authorized individuals will have access to resources, and that an authorized individual can only access resources within their clearance level. Another advantage is that MAC policies reduce security errors, meaning there are fewer instances of an individual accessing a file they are not authorized to view. The disadvantage of MAC is that it is more complex to manage. Only highly experienced systems administrators are able to work with MAC-enabled systems. An additional disadvantage is that the model can reduce system performance, because the system must check each access request against the applicable access rules before granting access.
The advantage of DAC is that it is easy to implement. A security policy can be set up without requiring extensive knowledge of information security. When using DAC, it is also possible for a user to transfer ownership of an object to another user (Choi et al., 2014). The disadvantage of DAC is its inherent vulnerability to malicious programs, since DAC is susceptible to processes that can execute malicious code.
RBAC has the advantage of reducing administrative work. When using RBAC, administrators can add and switch roles quickly and implement them globally across platforms, operating systems, and applications (Fadhel, Bianculli, & Briand, 2015). There is also a reduced potential for errors when assigning user permissions. RBAC further maximizes operational efficiency by allowing all roles to be aligned with the organizational structure of the company. However, RBAC is prone to role explosion: in many instances, administrators add roles to users but do not remove them when the user's responsibilities change.
References
Choi, C., Choi, J., & Kim, P. (2014). Ontology-based access control model for security policy reasoning in cloud computing. The Journal of Supercomputing, 67(3), 711–722.
Fadhel, A. B., Bianculli, D., & Briand, L. (2015). A comprehensive modeling framework for role-based access control policies. Journal of Systems and Software, 107, 110–126.
Kerr, L., & Alves-Foss, J. (2016). Combining mandatory and attribute-based access control. Paper presented at the System Sciences (HICSS), 2016 49th Hawaii International Conference on.
Younis, Y. A., Kifayat, K., & Merabti, M. (2014). An access control model for cloud computing. Journal of Information Security and Applications, 19(1), 45–60.
Create your account
Always verify citation format against your institution’s current style guide requirements.