Computer Security Resource Center

Computer Security Resource Center

Computer Security
Resource Center

A  |  B  |  C  |  D  |  E  |  F  |  G  |  H  |  I  |  J  |  K  |  L  |  M  |  N  |  O  |  P  |  Q  |  R  |  S  |  T  |  U  |  V  |  W  |  X  |  Y  |  Z

Risk Adaptive (Adaptable) Access Control

Abbreviation(s) and Synonym(s): Definition(s):

  A form of access control that uses an authorization policy that takes into account operational need, risk, and heuristics.
Source(s):
CNSSI 4009-2015 under risk adaptable access control (RAdAC)

  In RAdAC, access privileges are granted based on a combination of a user’s identity, mission need, and the level of security risk that exists between the system being accessed and a user. RAdAC will use security metrics, such as the strength of the authentication method, the level of assurance of the session connection between the system and a user, and the physical location of a user, to make its risk determination.
Source(s):
NIST SP 800-95 under Risk-Adaptive Access Control (RAdAC) (Department of Defense (DoD) Information Assurance (IA) and Computer Network Defense (CND) Strategies: A Comprehensive Review of Common Needs and Capability Gaps State-of-the-Art Report (SOAR) (21 July 2005 - TAT-06284 ) - (accessible from .mil and .gov domains only))