What Does DAC Mean?

Discretionary Access Control, or DAC, is a way of managing who gets to use files and other resources on a computer or network. The word "discretionary" is the key here. It means that the owner of a resource gets to use their own judgment, or discretion, to decide who else can access it. This is very different from other systems where a central administrator makes all those decisions.

Imagine you have a digital photo album on your laptop. Under DAC, you are the owner of that album. You can decide to share it with your best friend by giving them read-only access, meaning they can look at the photos but not change or delete them. You could also give your family full control, allowing them to add or remove pictures. The important point is that the power sits with you, the owner. This is how many everyday computer systems work. When you right-click a folder in Windows and go to Properties, then the Security tab, you are looking at the DAC settings for that folder.

In contrast, a Mandatory Access Control (MAC) system would not let you make those choices. Instead, a central administrator would set rules based on security labels, and you would have no say in who else can see your files. DAC is more flexible and user-friendly, which is why it is so common. However, this flexibility also creates risk. If a user is not careful and gives too many people access to a sensitive file, a data breach can happen. For IT professionals, understanding DAC is the first step toward securing any environment, because it is the default access control model for most operating systems and applications.

Discretionary Access Control (DAC) is an access control model defined by the Trusted Computer System Evaluation Criteria (TCSEC), also known as the Orange Book. In DAC, the owner of an object-such as a file, directory, or registry key-has the authority to grant or revoke access permissions to other subjects (users or processes) at their own discretion. The identity of the subject and the permissions it holds are used to determine access, typically enforced through an access control list (ACL) associated with each object.

In modern operating systems like Windows, Linux, and macOS, DAC is implemented using ACLs. Each object has a security descriptor that includes a DACL (Discretionary Access Control List). The DACL contains a list of access control entries (ACEs). Each ACE specifies a security identifier (SID) for a user or group, along with the allowed or denied permissions (e.g., read, write, execute, delete). When a subject attempts to access an object, the system checks the DACL in order. If a matching ACE denies access, the request is denied. If no deny ACE is found but an allow ACE matches, access is granted. If no ACE matches at all, access is implicitly denied.

DAC is contrasted with Mandatory Access Control (MAC) and Role-Based Access Control (RBAC). In MAC, system-wide policies override user permissions, and labels like Top Secret and Secret are used. In RBAC, permissions are assigned to roles, and users are assigned to roles. DAC is more granular and user-driven, making it suitable for environments where users need flexible sharing capabilities. However, DAC is vulnerable to attacks such as privilege escalation via Trojan horses. If a user with DAC permissions runs malicious code, that code can inherit the user's permissions and access resources the user did not intend to share. This is a major security consideration.

DAC is a core topic in CompTIA Security+, ISC2 CC, and ISC2 CISSP exams. Candidates must understand the difference between DAC, MAC, and RBAC. They must also know the structure of ACLs, the difference between explicit and inherited permissions, and the principle of least privilege as it applies to DAC environments.

DAC is the default access control model in virtually every desktop operating system and many applications. For IT professionals, understanding DAC is not optional; it is foundational. When you troubleshoot a permission issue in Windows where a user cannot access a shared folder, you are diagnosing a DAC problem. When you configure file shares on a Linux server using chmod and chown, you are applying DAC principles.

From a security perspective, DAC has both strengths and weaknesses. The strength is that it empowers users to manage their own resources, which reduces the workload on system administrators. A user can share a project folder with a teammate without needing to submit a ticket to IT. The weakness is that users often make mistakes. They may grant full control to everyone in the company, or they may not realize that inherited permissions are giving broader access than intended. This is why security auditors often check for excessive DAC permissions. The principle of least privilege must be applied to DAC: each user should only have the minimum permissions needed to do their job.

DAC also plays a role in compliance. Regulations like GDPR and HIPAA require organizations to control access to personal data. If an employee sets a DAC permission that allows all employees to read a sensitive file, that could be a compliance violation. Therefore, IT teams often implement monitoring tools to track DAC changes and alert on risky permissions. Understanding DAC is crucial for anyone pursuing a career in system administration, security analysis, or network engineering.

DAC appears in multiple question formats across certification exams. The most common is the scenario-based multiple-choice question. For example: "A user creates a spreadsheet and grants read-only access to her team members. Which access control model is being used?" The answer is Discretionary Access Control because the owner set the permissions. Another variation: "An administrator needs to implement a model where users can control access to their own files. Which model should be chosen?" Again, DAC.

Another question type involves comparing models. You might see: "Which of the following is a disadvantage of DAC?" The correct choice is often "It is vulnerable to Trojan horse attacks" because a malicious program can inherit the user's access rights. Or "Which model allows the owner to transfer ownership?" That is also DAC.

Configuration questions are less common but appear in Security+ performance-based questions where you must identify the correct NTFS permissions for a shared folder. Troubleshooting questions may describe a situation where a user cannot access a file even though they were granted permission. The cause might be an explicit deny ACE in the DACL that overrides an allow ACE. Knowledge of how DACL ordering works (deny entries typically evaluated first) is important.

Finally, some questions test your understanding of DAC terminology. For instance: "What is the list of ACEs associated with an object called?" Answer: DACL. Or "In DAC, who can change permissions on an object?" Answer: The owner. These questions are straightforward if you know the definitions. Practice tests will help you get comfortable with the language used.

DAC is not just a theoretical concept; it is something IT professionals deal with daily. In a Windows environment, every file, folder, registry key, and printer has a security descriptor that includes a DACL. When a user complains they cannot access a network share, the first step is to check the share permissions and the NTFS permissions. Share permissions are also DAC-based, but they apply at the network level, while NTFS permissions apply locally. The effective permission is the most restrictive combination.

Linux file permissions are also a form of DAC. The chmod command sets read, write, and execute for the owner, group, and others. The owner can change these. However, Linux also has ACLs (via setfacl/getfacl) that provide more granular control, similar to Windows DACLs. Understanding how to set and troubleshoot these permissions is essential for any system administrator.

What can go wrong? The most common issue is over-permissioning. Users often set files to 'Everyone' or 'World' to fix a problem quickly, creating a security hole. Another issue is permission inheritance. In Windows, child objects inherit permissions from their parent by default. If you set restrictive permissions on a parent folder but forget to disable inheritance on a subfolder, the child may inherit less restrictive permissions from elsewhere. Always check effective permissions.

From a security perspective, the biggest risk with DAC is the Trojan horse attack. If a user runs a malicious program, that program runs with the user's DAC rights. It can read, modify, or delete any file the user has access to. This is why running with least privilege is critical. For exams, remember that DAC is vulnerable to this, but MAC would prevent it because the program would have a different security label. Practical takeaway: always run applications with the minimum privileges needed, and use tools like Windows Integrity Control or Linux capabilities to reduce risk.