17. Mandatory Access Control (MAC)

Mandatory Access Control (MAC)

MAC is an access control model where rules are enforced uniformly across the entire system. Only designated security administrators can set or change access permissions.

Restricted User Control

Users are given only a defined subset of privileges, and they cannot pass information to unauthorized users, grant their privileges to others, change security settings, assign security attributes, or change access control rules.

MAC vs DAC

The key difference between MAC and DAC is control: in MAC, security administrators control access; in DAC, the object owner controls access.

Main Idea

MAC centrally enforces access rules, and only authorized administrators can manage permissions.