Attribute-based access control (ABAC), also referred to as policy-based access control (PBAC) or claims-based access control (CBAC), is an authorization methodology that sets and enforces policies based on characteristics, such as department, location, manager, and time of day. Using Boolean logic, ABAC creates access rules with if-then statements that define the user, request, resource, and action. For example, if the requester is a salesperson, they are granted read-write access to the customer relationship management (CRM) solution, as opposed to an administrator who is only granted view privileges to create a report.
With account-based access control, dynamic, context-aware security can be provided to meet increasingly complex IT requirements. Use cases for ABAC include:
- Protecting data, network devices, cloud services, and IT resources from unauthorized users or actions
- Securing microservices / application programming interfaces (APIs) to prevent exposure of sensitive transactions
- Enabling dynamic network firewall controls by allowing policy decisions to be made on a per-user basis
Components of ABAC
Attributes are the characteristics or values of components that are used in an access event. These attributes can be drawn from several data sources, including identity and access management (IAM) systems, enterprise resource planning (ERP) systems, employee information from an internal human resources system, customer information from a CRM, and from lightweight directory access protocol (LDAP) servers.
Characteristics that can be used when making a determination to grant or deny access include the following.
Subject or user attributes
Subject or user attributes describe who is attempting to obtain access to a resource in order to perform an action. These can include username, age, job title, citizenship, user ID, department and company affiliation, security clearance, management level, and other identifying criteria. ABAC systems can collect this information from authentication tokens used during login, or it can be pulled from a database or system (e.g., an LDAP, HR system).
Object or resource attributes
Object or resource attributes encompass characteristics of an object or resource (e.g., file, application, server, API) that has received a request for access. Examples of object or resource attributes are creation date, last updated, author, owner, file name, file type, and data sensitivity.
Environmental or context attributes
Environmental attributes indicate the broader context of access requests. Environmental attributes can be a variety of contextual items, such as the time and location of an access attempt, the subject’s device type, communication protocol, authentication strength, the subject’s normal behavior patterns, the number of transactions already made in the past 24 hours, or even relationship with a third party.
Action attributes indicate how a user wants to engage with a resource. Examples of common action attributes in access requests are view, read, write, copy, edit, transfer, delete, or approve. These can be used individually or in combination for more complex scenarios.
|Subject or User Attributes||Object or Resource Attributes||Environmental or Context Attributes||Action Attributes|
|Current Day |
How attribute-based access control works
ABAC grants permissions according to who a user is rather than what they do, which allows for granular controls. Attributes are analyzed to assess how they interact in an environment; then, rules are enforced based on relationships.
Here is how the process typically works:
- An access request is made.
- The attribute-based access control tool scans attributes to determine if they match existing policies.
- Based on the result of the ABAC tool’s analysis, permission is granted or denied.
Benefits of ABAC
The attribute-based access control authorization model has unique capabilities that provide powerful benefits to organizations, including the following.
Broad range of policies
Virtually any kind of policy can be created as ABAC’s only limitations are the attributes and the conditions the computational language can express.
Attribute-based access control allows situational variables to be controlled to help policy-makers implement granular access.
It also enables administrators to use smart access restrictions that provide context for intelligent security, privacy, and compliance decisions. For instance, one group of employees may only have access to some types of information at certain times or only in a particular location.
Easy to use
Attribute-based access control is very user-intuitive. It hides technical permission sets behind an easy-to-use interface. Anyone with the right permissions can update a user profile and be assured that the user will have the access they need as long as their attributes are up to date. In addition, the maximum number of users can be granted access to the maximum available resources without administrators having to specify relationships between each user and object.
Fast onboarding of new users
ABAC models expedite the onboarding of new staff and external partners by allowing administrators and object owners to create policies and assign attributes that give new users access to resources. With attribute-based access control, existing rules or object characteristics do not need to be changed to grant this access.
With ABAC, almost any attribute can be represented and automatically changed based on contextual factors, such as which applications and types of data users can access, what transactions they can submit, and the operations they can perform.
The increased security provided by attribute-based access control’s granular permissions and controls helps organizations meet compliance requirements for safeguarding personally identifiable information (PII) and other sensitive data set forth in legislation and rules (e.g., Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR), Payment Card Industry Data Security Standard (PCI DSS)).
Once ABAC has been set up, administrators can copy and reuse attributes for similar components and user positions, which simplifies policy maintenance and new user onboarding.
Challenges of attribute-based access control
Once it has been deployed, ABAC is simple to scale and integrate into security programs, but getting started takes some effort. While most agree that the benefits of ABAC far outweigh the challenges, there is one that should be considered—implementation complexity. This is because administrators must:
- Assign attributes to every component.
- Create a central policy engine to determine what attributes are allowed to do, based on various conditions (i.e., if X, then Y).
- Define all attributes.
- Gauge the permissions available to specific users before all attributes and rules are in place.
- Map authorization policies to create a comprehensive policy set to govern access.
ABAC vs RBAC
Attribute-based access control and role-based access control are both access management methods. Unlike ABAC, RBAC grants access based on flat or hierarchical roles. With RBAC, roles act as a set of entitlements or permissions.
|Existing roles extended with attributes and policies (e.g., the relevant actions and resource characteristics, the location, time, how the request is made).||Each user is assigned a role|
|Authorization based on intelligent decisions.||Authorization only considers the role and associated privileges|
|Policies are based on individual attributes, consist of natural language, and include context||Access is granted only by roles|
|Administrators can add, remove, and reorganize attributes without rewriting the policy||New roles must be manually defined|
|Access is fine-grained||Broad access is granted across the enterprise|
Choosing between ABAC and RBAC
Whether attribute-based access control or role-based access control is the right choice depends on the enterprise’s size, budget, and security needs. Size plays a big part in the choice as ABAC’s initial implementation is cumbersome and resource-intensive.
|Resources to support a complex implementation process||Need access controls, but lack resources for a complex implementation process|
|A large number of users with dynamic roles||Well-defined groups within the organization|
|Large organization with consistent growth||Organizational growth not expected to be substantial|
|Workforce that is geographically distributed||Workforce that is centrally located|
|Need for deep, specific access control capabilities||Comfortable with broad access control policies|
ABAC and RBAC: A hybrid approach
Attribute-based access control and role-based access control can be used in conjunction to benefit from RBAC’s ease of policy administration with the flexible policy specifications and dynamic decision-making capabilities of ABAC. Using ABAC and RBAC (ARBAC) can provide powerful security and optimize IT resources.
The ARBAC hybrid approach allows IT administrators to automate basic access and gives operations teams the ability to provide additional access to specific users through roles that align with the business structure. By making roles attribute-dependent, limitations can be applied to specific users automatically without searching or configurations.
This streamlines access assignments and minimizes the number of user profiles that need to be managed. With ARBAC, IT teams can essentially outsource the workload of onboarding and offboarding users to the decision-makers in the business.
For example, ARBAC can be used to enforce access control based on specific attributes with discretionary access control through profile-based job functions that are based on users’ roles. ARBAC can also be to support a risk-adaptable access control model with mutually exclusive privileges granted such that they enable the segregation of duties.
Support organizational security with ABAC
Attribute-based access control has become widely accepted as the authorization model of choice for many organizations. Not only is it incredibly powerful, but it eases part of the security administration burden.
You might also be interested in:
Take control of your cloud platform.
Learn more about SailPoint and Access Modeling.