The preferred access control mechanism for an IT infrastructure project with high employee turnover is Role-Based Access Control (RBAC). RBAC is a type of access control model that assigns permissions to users based on their roles or functions within the organization, rather than on their individual identities or attributes. RBAC can be preferred for an IT infrastructure project with high employee turnover because it can simplify the management and the administration of the user accounts and access rights. RBAC can reduce the administrative overhead and ensure the consistency and accuracy of the user accounts and access rights, by using predefined roles or groups that have defined privileges. RBAC can also facilitate the identity lifecycle management activities, such as provisioning, review, or revocation, by adding or removing users from the roles or groups based on their current jobs. RBAC can also provide some benefits for security, such as enforcing the principle of least privilege, facilitating the separation of duties, and supporting the audit and compliance activities. Attribute Based Access Control (ABAC), Discretionary Access Control (DAC), and Mandatory Access Control (MAC) are not the preferred access control mechanisms for an IT infrastructure project with high employee turnover, although they may be related or useful access control models. ABAC is a type of access control model that assigns permissions to users with policies that combine attributes together. Attributes are characteristics or properties of the users, the objects, the environment, or the actions. ABAC can provide some benefits for access control, such as enhancing the flexibility and the granularity of the permissions, supporting the dynamic and complex scenarios, and enabling the interoperability and scalability of the systems or the network. However, ABAC is not preferred for an IT infrastructure project with high employee turnover, as it can be difficult and costly to implement and manage, due to the large number and variety of attributes and policies, and the lack of standardization and validation of the attributes and policies. DAC is a type of access control model that assigns permissions to users based on their identities or their ownership of the objects. DAC is enforced by the owner or the creator of the object, who can grant or revoke permissions to other users at their discretion. DAC can provide some benefits for access control, such as enhancing the flexibility and the usability of the permissions, supporting the user collaboration and sharing, and enabling the user autonomy and responsibility. However, DAC is not preferred for an IT infrastructure project with high employee turnover, as it can be insecure and inconsistent, due to the lack of centralized control and oversight of the permissions, and the potential for excessive or unauthorized permissions. MAC is a type of access control model that assigns permissions to users and objects based on their security labels, which indicate their level of sensitivity or trustworthiness. MAC is enforced by the system or the network, rather than by the owner or the creator of the object, and it cannot be modified or overridden by the users. MAC can provide some benefits for access control, such as enhancing the confidentiality and the integrity of the data, preventing unauthorized access or disclosure, and supporting the audit and compliance activities. However, MAC is not preferred for an IT infrastructure project with high employee turnover, as it can be rigid and complex, due to the strict and predefined rules and policies of the permissions, and the difficulty and overhead of assigning and maintaining the security labels.
