| 🏠 Back to Exam Syllabus | 📺 RooCloud on YouTube | 🌐 RooCloud Practice Exams |
CISSP 14.1 - Comparing Access Control Models (Part 1 of 2)
This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series opens the study of how systems decide who gets to touch what, part of identity and access management in Domain 5. It unpacks the machinery behind authorization and the choices that keep access both smooth and safe.
What this episode covers
- Permissions, rights, and privileges — what you may do to an object, actions on the system, and the two bundled together.
- Implicit deny — the safe foundation where silence means no, so anyone not explicitly granted access is refused automatically.
- Matrices and capability lists — the same facts tracked from the object side and from the subject side.
- Constrained interfaces and content or context controls — hiding unauthorized controls and deciding access by what is inside or the surrounding conditions.
- Tight-grant principles — need to know, least privilege, and separation of duties working as checks and balances.
- Security policy — the leadership-approved document that names what to protect and how far to go without dictating configuration.
- Discretionary and role-based models — owner-controlled access lists versus role assignments that beat privilege creep.
Watch the full episode above for the worked examples and detailed explanations of each concept.
Frequently Asked Questions
What is the difference between permissions, rights, and privileges?
Permissions are what you can do to an object, like read, write, or delete a specific file. Rights are the ability to take an action on a system, like changing the clock or restoring a backup. Privileges are simply the two bundled together. Picture a building where permissions are which rooms you may enter, rights are which machines you may operate, and privileges are the master set an engineer carries.
How does a system enforce access by default?
Through a principle called implicit deny. Unless someone is explicitly granted access, the system refuses them, quietly and automatically. If you give one analyst full control of a shared file and mention no one else, everyone else is locked out even though you never named them. The absence of a yes is treated as a no, and this deny by default is the safe foundation under almost every mechanism.
What principles keep every access grant as tight as possible?
Three work together. Need to know limits people to only the data their job actually requires, even if they hold a broad clearance. Least privilege goes further and limits their rights to take action, not just their view of data. Separation of duties splits sensitive tasks across two or more people so no single person can commit fraud unchecked. Together they form a quiet system of checks and balances.
How does discretionary access control work?
In discretionary access control, whoever creates or owns an object controls access to it. Build a new spreadsheet and you own it, so you can hand out or revoke access as you please, and owners can delegate that power to a data custodian for daily upkeep. It runs on access control lists attached to each object, making it wonderfully flexible but never centrally governed, exactly how file permissions work on common desktop operating systems.
How does role-based access control avoid per-user grants?
By assigning privileges to roles instead of people. You define a role by job function, attach the right privileges once, then drop user accounts into it, so a new hire simply joins the role and instantly inherits the correct access. Move someone to a new department and you pull them from the role in one step, cleanly stripping those privileges. This is what stops privilege creep, the slow pile-up of access people accumulate but never lose.
📚 Master the ISC2 CISSP Exam!
Ready to test your knowledge? Access chapter-specific Multiple Choice Questions (MCQs) and full-length practice exams for the ISC2 CISSP certification at RooCloud.com. Solve the chapter-wise questions to reinforce this lesson before moving to the next episode.
Reference: This article is based on concepts discussed in CISSP 14.1 - Comparing Access Control Models (Part 1 of 2).