Multi-Dimensional Security 101: A Beginners Guide to Attribute Based Access Control 

Axiomatics   ·   Monday, July 13th, 2020

As new technologies emerge and hackers continue to develop new techniques, your enterprise data becomes more vulnerable each day. The days of storing information in a single, on-premise database are over. As a result, businesses are searching for new, modern technologies and techniques to secure their most critical information assets. 

Whether your enterprise needs to secure data on-premise, in the cloud, in a hybrid environment, or to secure access to APIs and microservices, Attribute Based Access Control (ABAC) is the most comprehensive access control model on the market. ABAC enforces enterprise-wide access based on business policies and regulations to meet the ever-evolving security challenges in the digital age, making ABAC truly multi-dimensional. 

Multi-Dimensional Access Control 

ABAC utilizes attributes that can describe virtually any access control scenario, regardless of the complexity of the situation. For example, you can utilize user attributes, action attributes, context attributes like device and location, or resource attributes like a record’s sensitivity. With attributes established, organizations can build precise policies to govern dynamic, scalable, and centralized access to information. 

 Typically, ABAC is also implemented in conjunction with some sort of fine-grained policy language and built on the premises of ABAC. This means the language must express complex rules in corporate policies and regulations to combine multiple attributes and implement specific policy requirements. Policies are written to satisfy extremely complicated authorization rights, making ABAC extremely flexible and expressive to both share and limit access as conditions demand.

 With ABAC, businesses can build a comprehensive access control system that through the combination of attributes and policies prevents role explosion, increases scalability, enables relationships between systems, enforces segregation of duty (SoD) conflicts and externalizes authorization to simplify management control. ABAC also helps organizations establish compliance with demanding regulatory environments across the globe. 

 ABAC Solves Business Challenges Across Industries

ABAC can resolve many access control obstacles. One example comes from the financial services industry where a bank’s authorization was domain-specific, meaning policies were defined, governed and implemented by the application owners themselves, and nobody else. A domain-specific approach delivered adequate functionality within data silos but no control or transparency throughout the enterprise data supply chain. 

With the General Data Protection Regulation (GDPR), the bank needed a central, scalable, and standardized solution to prepare for future regulatory challenges. By leveraging ABAC, the bank addressed various specific use cases and instituted authorization enterprise-wide to ensure the privacy of customer financial information. 

Manufacturing companies also face similar challenges. For example, one auto manufacturer dealt with a consolidation challenge for their authorization. They managed security authorization siloed within individual business units. The manufacturer wanted a standardized approach to access control and built their own authorization engine. 

However, challenges quickly arose. The auto manufacturer couldn’t handle system maintenance while simultaneously scaling and growing. The manufacturer saw bottlenecks in authorization because the system was not fully meeting their authorization challenges. By transitioning to an ABAC model, they established a centralized, externalized, dynamic and adaptable approach to eliminate authorization challenges and establish fine-grained access control. 

Access control has transformed to meet the evolving security challenges organizations face between industries. To address complex security threats, ABAC is now a must for businesses in need of a robust and flexible access control model to protect access to sensitive information and ensure regulatory compliance.