Definition
Mandatory access control MAC is a security model where access decisions are enforced by a central authority, not by individual users or data owners. Subjects, like users or processes, are assigned security labels, and objects, like files or devices, are also assigned security labels. Access is granted only if the subject's security label meets or exceeds the object's security label according to predefined rules. This strict, system-wide enforcement prevents unauthorized access even if a user has legitimate access to other resources. MAC is crucial for protecting highly sensitive data in environments like government or military systems. For instance, a classified document might have a high security label, preventing any user without the appropriate clearance from accessing it, regardless of their general system permissions. This differs from discretionary access control DAC, where users can set permissions for their own files. MAC is a key concept tested on CompTIA Security+ and CISSP exams.