Definition
Attribute-based access control or ABAC is a cybersecurity model that grants or denies access to resources based on attributes associated with the user, the resource, and the environment. Instead of assigning permissions to specific users or groups, ABAC evaluates policies that use attributes like user role, project affiliation, time of day, or data sensitivity. This dynamic approach allows for highly granular and flexible access management, adapting to changing conditions and user contexts. For example, an ABAC policy might allow a marketing team member access to project documents only during business hours and from a company IP address. This contrasts with role-based access control (RBAC) which assigns permissions based on predefined roles, making ABAC more adaptable to complex organizational structures. ABAC is a key concept tested on exams like CompTIA Security+, CySA+, and CISSP.