Cybersecurity — Authorization

Authorization models

1. DAC: Discretionary Access Control
2. MAC: Mandatory Access Control
3. RBAC: Role-Based Access Control
4. ABAC: Attribute-Based Access Control

RBAC implementation

class RBAC:
    def __init__(self):
        self.roles = {
            'admin': ['read', 'write', 'delete'],
            'editor': ['read', 'write'],
            'viewer': ['read']
        }
        self.user_roles = {}
    
    def assign_role(self, user, role):
        self.user_roles[user] = role
    
    def check_permission(self, user, permission):
        role = self.user_roles.get(user, '')
        return permission in self.roles.get(role, [])

JWT authorization

import jwt

# Create token
token = jwt.encode(
    {'user_id': 123, 'role': 'admin'},
    'secret_key',
    algorithm='HS256'
)

# Verify token
decoded = jwt.decode(token, 'secret_key', algorithms=['HS256'])

Access control lists

acl = {
    '/admin': ['admin'],
    '/editor': ['admin', 'editor'],
    '/public': ['admin', 'editor', 'viewer']
}

def check_access(path, role):
    return role in acl.get(path, [])

Best practices

1. Apply least privilege
2. Use RBAC/ABAC
3. Audit access logs
4. Review permissions regularly

Mini Practice

1. Implement RBAC
2. Use JWT for authorization
3. Set up access control
4. Audit permissions

Up Next

Continue with Encryption - Data protection.