attribute based access control

Taking Cybersecurity A Step Further With Attribute-Based Access Control

Most organizations already have firewalls implemented, encrypted critical data assets, and monitor network activity as part of an overall cybersecurity plan, but there is another line of defense that can provide additional value: the use of attribute based access control (ABAC) to reduce the threat surface, thereby improving overall security as well as mitigating risks associated with breaches.

NIST Report Reflects Increasing Need for ABAC Then Over-Engineers Its Deployment

by Andy Han The National Institute of Technology and Standards (NIST) held a conference a few months back on Attribute Based Access Control (ABAC).  The primary objective of the conference was to promote a special publication on ABAC and the event brought together leaders from various government programs, technology vendors, industry analysts and subject matter experts on authorization and access control.  The event and paper are recognition that the adoption of ABAC is accelerating and that we needed to put in writing a shared understanding of when and how to deploy ABAC.  There was agreement on the central of the drivers for the adoption of ABAC: Organizations, including the federal government, need to govern how information is shared across systems, applications, and organizations.  The document’s purpose is thus to (1) establish a standard definition of ABAC and a description of its functional components and (2) provide “planning, design, implementation, and operational considerations for employing ABAC within a large enterprise with the goal of improving information sharing while maintaining control of that information” (vii). ABAC is endorsed by NIST as the best approach for this particular challenge because of the fundamentals of its design. ABAC allows organizations to pass attributes back and forth as information is shared across application, infrastructure, and organizational boundaries. Access control policies use those attributes to evaluate the relationships between subjects and objects and determine whether to allow an action. One of the core technical benefits of ABAC, according to the report, is “ABAC avoids the […]