The scenario describes Role-based Access Control (RBAC). In this model, access permissions are assigned to predefined roles, and users are then assigned to those roles based on their job function or group membership. A department is a classic example of a role. All users within a specific department (e.g., "Sales," "Engineering") inherit the permissions associated with that role. This simplifies administration by managing permissions for groups rather than for each individual user, which directly matches the practice described.

A. Attribute-based: ABAC uses policies that evaluate multiple attributes (e.g., user clearance, resource sensitivity, location, time of day) for more granular, dynamic access decisions, which is more complex than the described model.

C. Context-based: This model considers real-time contextual factors like the state of the system, location, or time of day to make an access decision, none of which are mentioned.

D. Discretionary: In DAC, the owner of a resource grants permissions to other users. The scenario implies a centralized, company-wide policy, not decisions made by individual resource owners.

1. National Institute of Standards and Technology (NIST). (2013). Special Publication 800-162: Guide to Attribute Based Access Control (ABAC) Definition and Considerations. Section 2.3

"Comparison of ABAC to Other Access Control Models

" states

"In the RBAC model

roles are created for various job functions in an organization... Permissions to perform certain operations are assigned to specific roles." This directly supports using a department as a role.

2. Sandhu

R. S.

Coyne

E. J.

Feinstein

H. L.

& Youman

C. E. (1996). Role-based access control models. IEEE Computer

29(2)

38-47. In Section 2

"The RBAC Framework

" the paper defines roles as corresponding to job functions or work-groups within an organization

such as a department. (DOI: https://doi.org/10.1109/2.485845)

3. Ferraiolo

D. F.

& Kuhn

D. R. (1992). Role-Based Access Control. Proceedings of the 15th National Computer Security Conference. The foundational paper on RBAC defines the model where permissions are associated with roles

and users acquire permissions by being members of roles. A department is a direct implementation of such a role. (Available via NIST CSRC publications).