Classify each of the following as an example of a mandatory, (Mandatory Access C
ID: 3810462 • Letter: C
Question
Classify each of the following as an example of a mandatory, (Mandatory Access Control, or rule-based access control) discretionary, (Discretionary access control or identity-based access control) or originator controlled policy, (originator controlled access) or a combination thereof. Additionally, state who is the creater, who is the owner of the object, what is the computer system, who is the admin of the system, and who decides the permission for your selected type of access control
a. The file access control mechanisms of the UNIX operating system
b. A system in which no memorandum can be distributed without the authors consent
c. A military facility in which only generals can enter a particular room
d. A university registrar's office, in which a faculty member can see the grades of a particular student provided that the student has given written permission for the faculty member to see them.
Explanation / Answer
a.Discretionary Access Control
Since users can assign and modify permissions that they possess, access control is discretionary.
b.Originator Access Control
Because if I am the author of the memorandum I am the one who can say my information can be distributed, no one else can.
c.Mandatory Access Control
The system controls access and an individual cannot change that.
D.Discretionary Access Control
Here the student grants the permission to the faculty to see the grades. If he doesn’t grant permission to
a particular faculty member, that faculty member can’t see the grades.