- [Narrator] Attribute-Based Access Control
or ABAC is a further evolution
of access control model to adapt
to organizations that need more complex
access control models.
And this will take into consideration other factors
besides the identity or the role.
Examples of these factors are the user's location, time,
or temporal constraints, and the level
of risk, or even threat information.
And there may be others as well.
So ABAC describes an access control model where
the authorization decision is based on attributes
which are designed and assigned to subjects and to objects
also environmental conditions and a set of policies
which are linked to these attributes and conditions.
Attributes are defined as characteristics
that belong to a subject, that means a user.
An object, that means a resource.
Or an environment.
For example, a subject attribute could be the name,
the nationality, the organization, a role,
some type of identifier, even a security clearance,
and many others of that subject.
Examples of object attributes are things like name, owner,
so the owner of the resource when the
resource or the data was actually created and so on.
Now environment conditions are instead
contextual information associated to the access request.
You know, things like location of the access,
time of the access, threat levels.
These are all examples of attributes of the environment.
Now, every object should also be associated
with at least one policy.
This regulates in which operations a subject could perform
on the object. So which operations
that a user can actually do or perform on that object.
This is done by examining the attributes
and the environmental constraints.
These are key concepts related
to Attribute Based Access Control model or ABAC.
Attribute Based Access Controls are controls
where the access decision is taken based
on the attributes associated to subjects, objects,
and environment.
Attributes are characteristics that belong
to a subject or a user, objects
or resource, or the environment.
Then another thing to remember is
that the user role identity
and security classification could be considered also
as attributes.