Organizations could implement attribute based access control to further enhance access control capabilities by considering a variety of user and device factors in authorization decisions.

Control Type: Technical

Control Function: Preventive

In modern digital environments, it is not enough to simply approve access to a user with a username and password combo and call it good. Authentication and authorization decisions need to be made by taking in more context to further reduce the risk of account compromise. Attribute based access control (ABAC) is a powerful access control model that allows organizations to factor in a variety of unique user attributes to every decision. ABAC can be used alongside other base access control models like Role Based Access Control.

The attributes in question that can be utilized in an ABAC deployment can be organizationally defined, environmental, and resource specific. This means that the authorization decisions are not just made based on whether a user provided a correct password; they are also made based on who the user is, where they are trying to access from, what they are trying to access, and when. Some of the common attributes factored in ABAC include:

  • Job function
  • Role
  • Department/team
  • Action being performed (read, write, delete)
  • Time of day
  • Geolocation
  • Data classification
  • Data type
  • Device risk/trust score
  • User risk/trust score

Organizations can craft their own unique access control rules based on any combination of such attributes. ABAC can also be expanded throughout an entire session using features such as Conditional Access, where user sessions are continuously monitored for suspicious changes in security posture or behavior.

ABAC requires proper testing and fine tuning to be successful, otherwise organizations risk making access controls too restrictive or too lenient. It is important to start by identifying what specific attributes are appropriate for the organization’s use case, then building up rules based on both the available attributes, and the organization’s risk appetite.