The National Institute of Technology and Standards (NIST) held a conference a few months back on Attribute Based Access Control (ABAC).

The primary objective of the conference was to promote a special publication on ABAC and the event brought together leaders from various government programs, technology vendors, industry analysts and subject matter experts on authorization and access control.

The event and paper are recognition that the adoption of ABAC is accelerating and that we needed to put in writing a shared understanding of when and how to deploy ABAC.

There was agreement on the central of the drivers for the adoption of ABAC: Organizations, including the federal government, need to govern how information is shared across systems, applications, and organizations. 

The document’s purpose is thus to (1) establish a standard definition of ABAC and a description of its functional components and (2) provide “planning, design, implementation, and operational considerations for employing ABAC within a large enterprise with the goal of improving information sharing while maintaining control of that information”.

ABAC is endorsed by NIST as the best approach for this particular challenge because of the fundamentals of its design. ABAC allows organizations to pass attributes back and forth as information is shared across application, infrastructure, and organizational boundaries.

Access control policies use those attributes to evaluate the relationships between subjects and objects and determine whether to allow an action.

One of the core technical benefits of ABAC, according to the report, is “ABAC avoids the need for explicit authorizations to be directly assigned to individual subjects prior to a request to perform an operation on the object” […]

Source nextlabs.wordpress.com