- [Instructor] Once authenticated,
a subject must be authorized.
Authorization is the process
of assigning authenticated subject's permission
to carry out a specific operation.
The authorization model
defines how access rates and permissions are granted.
The three primary authorization models are
object capability, security labels, and ACLS.
Object capability is used programmatically
and is based on a combination
of unfordable reference and operational message.
Security labels are mandatory access controls
embedded in object and subject properties.
Examples of security labels,
based on its classification,
are confidential, secret, and top secret.
Access control lists, or ACLS, are used
to determine access based on
some combination of specific criteria,
such as a user ID, group membership,
classification, location, address, and date.
Additionally, when granting access,
the authorization process would check
the permissions associated with the subject or object pair,
so that the correct access right is provided.
The object owner and management usually decide
or give input on the permission
and authorization policy
that governs the authorization process.
The authorization policy and rule
should take various attributes into consideration,
such as the identity of the subject,
the location from where the subject is requesting access,
the subject's role within the organization,
and so on.
Access control models,
which are described in more detail later in this lesson,
provide the framework
for authorization policy implementation.
An authorization policy should implement two concepts.
Implicit deny,
if no rule is specified for the transaction
of the subject object,
the authorization policy should deny the transaction.
And need-to-know,
where a subject should be granted access to an object
only if the access is needed
to carry out the job of the subject.
You learned about the least privileged principle
and need-to-know concepts earlier in this lesson.