- [Instructor] Discretionary access control systems
offer a flexible approach to authorization allowing users
to assign access permissions to other users.
The owners of files, computers, and other resources
have the discretion to configure permissions
as they see fit.
Discretionary access control systems are the most common
form of access control because they provide organizations
with needed flexibility.
Imagine if users in your organization
didn't have the ability to assign file rights to other users
as needed and IT had to be involved in every request.
That would certainly make life difficult, wouldn't it?
Let's look at an example
of a discretionary access control system.
Imagine that we have a file containing information
on some of the organization's employees.
Alice, an analyst within human resources, created the file
and the operating system recognizes her as the file owner.
Alice however, created this file at Bob's request
and she wants Bob to have permission to do everything that
Alice can do.
So Alice gives Bob full control permission over that file.
Alice also knows that Carol needs to occasionally
make updates to the file,
so she assigns Carol read and write permission.
Bob wants his boss Tracy,
to be able to look at the file as well.
But Bob does not want Tracy to make modifications
to the file.
Since Bob has full control of the file,
he can also set permissions for other users
so he goes ahead and grants Tracy read permission.
Tracy and Carol can't modify the file permissions
because they are neither the file owners
nor do they have full control over the file.
This is a great example
of a discretionary access control system.
In this case, Alice and Bob both have the discretion
to change permissions on the file as they see fit.
In a mandatory access control scenario on the other hand,
Alice and Bob would not have the ability
to grant other users access to the file.
Permissions would be set by the operating system
based upon the file's classification.
The NTFS file system access control model
used on Windows discs is one of the most common examples
of a discretionary access control system.
It allows users who own a file
to assign each other various permissions.
We'll look more at NTFS access control lists
in the next video.