# Risk-Based Access Control Model: A Systematic Literature Review
## 2 An Overview of Access Control
### Dynamic Access Control Models
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Item** & **Traditional Access Control** & **Dynamic Access Control** \\ \hline \multirow{2}{*}{**Features**} & It uses predetermined and static policies to determine the access decision. & It uses access policies and contextual features that are collected at the time of making the access request to determine the access decision. \\ \hline \multirow{2}{*}{**Grant Decision**} & The access is granted only if it matches one of the rules in the access policy. & The access is granted based on the context and the policy. The decision can be overridden based on the context. \\ \hline \multirow{2}{*}{**Deny Decision**} & The access is denied only if it does not match any rule in the access policy. & The access is denied based on the context and the policy. The change in the context can lead to changing the decision immediately. \\ \hline \multirow{2}{*}{**Example**} & ACL, DAC, MAC, and RBAC are the common and popular approaches or examples of traditional access control. & Risk-based access control, trust-based access control, and combination of risk with trust are common examples of dynamic access control. \\ \hline \multirow{5}{*}{**Advantages**} & \(\bullet\) Easy to understand, test, and maintain. & \(\bullet\) Adapt to unpredicted situations and conditions that policies cannot expect. \\  & \(\bullet\) Faster to be produced. & \(\bullet\) Improve flexibility while accessing system resources. \\ \cline{1-1}  & \(\bullet\) Objective method, so the outcome is more accurate. & \(\bullet\) Resolving risks and threats in real time, especially when handling a previously unidentified threat. \\ \cline{1-1}  & \(\bullet\) No contextual data is required, so it faster in making access decisions. & \(\bullet\) Can literally save lives in healthcare and military applications. \\ \hline \multirow{5}{*}{**Weaknesseses**} & \(\bullet\) Cannot adapt to changes in situations and circumstances, which affect flexibility. & \(\bullet\) More complex, especially with many contextual attributes. \\ \cline{1-1}  & \(\bullet\) The policy is imperfect and do not have a plan for all contingencies, so many problems may arise. & \(\bullet\) Hard to identify effective contextual features for the access control model. \\ \cline{1-1}  & \(\bullet\) Not a scalable solution especially with a large number of users and objects. & \(\bullet\) Subjectivity in assigning a weight for each contextual feature. \\ \cline{1-1}  & \(\bullet\) Hard to modify/update access rights for individual users. & \(\bullet\) Time overhead for processing dynamic features with the policy. \\ \hline \multirow{2}{*}{**Applications**} & The applications that do not have access to real-time features/attributes such as the operating system. & Various dynamic and distributed systems need dynamic access control to provide more flexibility including IoT and cloud applications, etc. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison between traditional and dynamic access control approaches. ACL: Access Control List, DAC: Discretionary Access Control, IoT: Internet of Things, MAC: Mandatory Access Control, and RBAC: Role-Based Access Control.