InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Understanding ABAC policies that evaluate multiple attributes of subjects, resources, actions, and environment for fine-grained access decisions.
Overview
ABAC makes access decisions based on attributes (properties) of the subject, resource, action, and environment. This provides the most flexible and granular access control model, capable of expressing complex policies that RBAC cannot handle.
ABAC Decision Process
========================
Request Attributes
Subject: {role: "doctor", department: "cardiology", license: "active"}
Resource: {type: "patient_record", department: "cardiology", sensitivity: "high"}
Action: {type: "read"}
Environment: {time: "14:00", location: "hospital_network", device: "workstation"}
Policy: "Doctors can read patient records in their department during work hours from hospital network"
Evaluation
subject.role == "doctor" ✓
subject.department == resource.department ✓
subject.license == "active" ✓
environment.time between 08:00-18:00 ✓
environment.location == "hospital_network" ✓
→ ACCESS GRANTED
ABAC Components
| Component | Attributes | Example |
|---|---|---|
| Subject | Role, department, clearance, location | user.department = "finance" |
| Resource | Type, owner, sensitivity, classification | file.sensitivity = "high" |
| Action | Read, write, delete, approve | action.type = "approve" |
| Environment | Time, date, IP, device type, threat level | env.time = "business_hours" |
Python ABAC Implementation
Example
from datetime import datetime
from typing import Callable, List
class ABACPolicy:
"""Define an ABAC policy rule."""
def __init__(self, name: str, description: str,
condition: Callable, effect: str = "permit"):
self.name = name
self.description = description
self.condition = condition
self.effect = effect # "permit" or "deny"
class ABACEngine:
"""ABAC policy decision point."""
def __init__(self):
self.policies: List[ABACPolicy] = []
def add_policy(self, policy: ABACPolicy):
self.policies.append(policy)
def evaluate(self, subject: dict, resource: dict,
action: dict, environment: dict) -> dict:
"""Evaluate all policies and return access decision."""
context = {
"subject": subject,
"resource": resource,
"action": action,
"environment": environment
}
applicable = []
for policy in self.policies:
try:
if policy.condition(context):
applicable.append(policy)
except (KeyError, TypeError):
continue
# Deny overrides permit
for p in applicable:
if p.effect == "deny":
return {"decision": "DENY", "policy": p.name}
for p in applicable:
if p.effect == "permit":
return {"decision": "PERMIT", "policy": p.name}
return {"decision": "DENY", "policy": "default_deny"}
# Setup ABAC system
engine = ABACEngine()
# Policy: Doctors can access patient records in their department
engine.add_policy(ABACPolicy(
"doctor_department_access",
"Doctors access records in own department",
lambda ctx: (
ctx["subject"].get("role") == "doctor" and
ctx["resource"].get("type") == "patient_record" and
ctx["subject"].get("department") == ctx["resource"].get("department") and
ctx["action"].get("type") in ["read", "write"]
),
effect="permit"
))
# Policy: No access outside business hours for non-emergency
engine.add_policy(ABACPolicy(
"business_hours_restriction",
"Deny non-emergency access outside 8am-6pm",
lambda ctx: (
ctx["subject"].get("role") != "emergency_physician" and
not (8 <= ctx["environment"].get("hour", 12) <= 18)
),
effect="deny"
))
# Test
result = engine.evaluate(
subject={"role": "doctor", "department": "cardiology", "id": "D001"},
resource={"type": "patient_record", "department": "cardiology", "id": "P123"},
action={"type": "read"},
environment={"hour": 14, "location": "hospital", "ip": "10.0.1.50"}
)
print(f"Decision: {result['decision']} (Policy: {result['policy']})")
ABAC vs RBAC Comparison
| Feature | RBAC | ABAC |
|---|---|---|
| Granularity | Role-level | Attribute-level (very fine) |
| Flexibility | Static role assignments | Dynamic attribute evaluation |
| Complexity | Low-medium | High |
| Scalability | Role explosion problem | Scales with attributes |
| Context-aware | No (or limited) | Yes (time, location, etc.) |
| Standards | NIST RBAC | XACML, ALFA |
| Best for | Stable organizations | Dynamic, complex requirements |
Interview Questions
- When would you choose ABAC over RBAC?
- When access decisions depend on context (time, location, device), when you need fine-grained per-resource policies, when role explosion becomes unmanageable, or when policies need to consider relationships between subject and resource attributes.
- What is XACML and how does it relate to ABAC?
- XACML (eXtensible Access Control Markup Language) is the standard language for expressing ABAC policies. It defines a reference architecture with Policy Decision Point (PDP), Policy Enforcement Point (PEP), Policy Information Point (PIP), and Policy Administration Point (PAP).
- What are the challenges of implementing ABAC?
- Complex policy management, performance overhead of evaluating multiple attributes, difficulty in policy auditing/testing, attribute accuracy and freshness requirements, and higher initial implementation cost compared to RBAC.
- How can RBAC and ABAC be combined?
- Use RBAC for basic role assignment and ABAC for additional constraints on those roles. Example: Role "Manager" grants base permissions, ABAC adds constraints like "only during business hours" or "only for their department's data."
- Give an example of a policy that ABAC can express but RBAC cannot.
- "Employees can access documents only from their own department, during business hours, from a company-managed device, and only if the document's sensitivity level doesn't exceed their clearance." This requires evaluating multiple attributes simultaneously.
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for Attribute-Based Access Control (ABAC).
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this Information Security topic.
Search Terms
information-security, information security, information, security, access, control, attribute, based
Related Information Security Topics
Continue learning this concept
Access ControlRole-Based Access Control (RBAC) — Information SecurityUnderstanding RBAC implementation, role hierarchies, permission assignment, and best practices for enterprise access management.Access ControlIntroduction to Access ControlComprehensive overview of access control concepts, models, and mechanisms for controlling who can access resources in information systems.Access ControlDiscretionary Access Control (DAC)Understanding DAC where resource owners control access permissions, including Unix file permissions, Windows ACLs, and security implications.Access ControlMandatory Access Control (MAC)Understanding MAC systems where access decisions are enforced by the system based on security labels, covering Bell-LaPadula, Biba models, and SELinux.Access ControlZero Trust Security ArchitectureComprehensive guide to Zero Trust principles including never trust always verify, microsegmentation, continuous authentication, and implementation strategies.Operating System SecurityOS Access Control ModelsImplementing access control at the operating system level including DAC, MAC, capabilities, and security policies.