Concept - Discretionary Access Control
DAC: access based on the identity of the requestor and on access rules (authorizations) stating what requestors are or are not allowed to do (s.4). It is “discretionary” because an entity with access rights may, by its own volition, enable another entity to access a resource (s.4).
- The traditional method of implementing access control (s.6).
- Often provided with an access matrix (see Concept - Access Matrix) (s.12).
- Deck 03 s.6 notes that password authentication “is used in discretionary access control”.
| DAC | MAC | |
|---|---|---|
| Decision basis | identity + rules | labels vs clearances |
| Can holder pass access on by itself? | yes | no |
Related: Concept - Mandatory Access Control, Concept - Role-Based Access Control, Concept - Copy Flag and Transfer Rules. Appears in 04 Access Control - Chunk 01 (s.1-28).