+AC-03(13) Attribute-based Access Control

AC-03(13) Attribute-based Access Control

Control

Enforce attribute-based access control policy over defined subjects and objects and control access based upon [Assignement: attributes].

Discussion

Attribute-based access control is an access control policy that restricts system access to authorized users based on specified organizational attributes (e.g., job function, identity), action attributes (e.g., read, write, delete), environmental attributes (e.g., time of day, location), and resource attributes (e.g., classification of a document). Organizations can create rules based on attributes and the authorizations (i.e., privileges) to perform needed operations on the systems associated with organization-defined attributes and rules. When users are assigned to attributes defined in attribute-based access control policies or rules, they can be provisioned to a system with the appropriate privileges or dynamically granted access to a protected resource. Attribute-based access control can be implemented as either a mandatory or discretionary form of access control. When implemented with mandatory access controls, the requirements in [AC-3(3)](#ac-3.3) define the scope of the subjects and objects covered by the policy.

Assessment Objective

  1. the attribute-based access control policy is enforced over defined subjects;
  2. the attribute-based access control policy is enforced over defined objects;
  3. access is controlled based on [Assignement: attributes].

Assessment Method

Examine

Access control policy procedures addressing access enforcement system design documentation system configuration settings and associated documentation list of subjects and objects (i.e., users and resources) requiring enforcement of attribute-based access control policies system audit records system security plan other relevant documents or records

Interview

Organizational personnel with access enforcement responsibilities system/network administrators organizational personnel with information security responsibilities

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by AC-03(13) Attribute-based Access Control – Assessment Procedure
is blocked by Attribute-Based Access Control (ABAC)