Controlling Who Can Access What: Exploring Alternatives to RBAC

As part of their core business practices, organizations collect and generate large amounts of sensitive data. Protecting this data has become a major priority, especially in the era of data privacy laws like the EU’s General Data Protection Regulation (GDPR), which provides regulators with the power to levy heavy fines for non-compliance and data breaches.

Get Free Demo: Best GDPR Compliance Software in 2020

Data breaches can be performed using a variety of different attack vectors, and identifying every possible avenue that an attacker could use is probably outside the capabilities of many organizations. Even if this is not the case, many data breaches are caused by employee negligence, meaning that data has to be protected against even trusted insiders.

Protecting against data breaches requires limiting access to sensitive data and other valuable resources. Role-based access control (RBAC) is one good option for achieving this, but it isn’t the only one. Understanding the pros and cons of various access control solutions is essential to securing data in every situation.

What is Role-Based Access Control?

Role-Based Access Control is designed to limit a user’s permissions on a company’s network. Not every employee within the company needs access to every system or piece of data. The organization’s developers don’t really need access to budget data, and, while the finance department may have a valid need to access budget data, they have no reason to mess around with settings on the company’s firewall.

With Role-Based Access Control, an organization can limit an employee’s permissions on the network-based upon their job. Each user is assigned to a specific role, and, for each asset in the organization (whether physical system or data), permissions can be assigned based upon a user’s role. For example, this allows the organization to easily specify that certain users should have read-only access to a file, others should have editing permissions, and a third group shouldn’t be able to open it at all.

1. Alternatives to RBAC

While RBAC is one approach to access control, it isn’t the only one available. Two other alternatives to Role-Based Access Control are access control lists (ACLs) and attribute-based access control (ABAC), both of which have their own benefits and drawbacks.

An ACL is simply a table attached to a particular resource that describes what actions are allowed or disallowed. It explains which users are able to access a resource and the actions that they are allowed to take once they access it.

This type of access control is best used for low-level access control. For example, ACLs are commonly used in firewalls to specify which types of application traffic are allowed to flow through the firewall from each system on the network. A well-designed firewall ACL can lock down access to the company network, making it far more difficult to attack.

One issue with ACLs, compared to RBAC, is that they don’t scale as well. With Role-Based Access Control, users can be grouped into different “roles,” and each role is given certain permissions, while ACLs are designed primarily to manage access at an individual level. The other shortcoming of ACLs for network-wide access management is the granularity of the security that they provide. Unlike RBAC, while an ACL can manage access to a file, it can’t control how a user can edit a file if they have editing permissions in the ACL.

Also, Read: 10 Best Compliance Audit Software in 2020

• Attribute-Based Access Control

Attribute-based access control is another Alternative to RBAC. In an ABAC system, a user can be assigned a variety of different attributes describing their unique situation, like the fact that they are a manager and a member of the accounting department. Access rules for a particular resource can then be written in eXtensible Access Control Markup Language (XACML) to define Boolean logic that describes the permissions that should be granted to a user based on their attributes.

ABAC makes a tradeoff between security and efficiency. With ABAC, it is possible to compactly define very precise rules that govern access to a particular resource. This is ideal in situations where rules must be extremely granular to provide the desired level of security and control over the asset.

However, the process of evaluating whether or not a user should have access to a particular asset-based off on these rules can be slow and computationally expensive. The ABAC system needs to evaluate the full set of Boolean logic statements for a user’s collection of attributes to make a decision. This means that ABAC is a good choice in situations where access has to be tightly managed, but RBAC is a better choice when this is not the case, especially for resources that are frequently accessed.

2. Data Security Through Access Control

Employee negligence is a leading cause of data breaches. As a result, it is important to ensure that sensitive data and valuable resources are protected not only against malicious external threats but also well-meaning employees. No employee in the organization requires full access to the organization’s every asset. By using access control solutions like RBAC, ACLs, and ABAC, an organization can ensure that employees only have access to valuable resources if they have a legitimate business case.

Access control solutions like Role-Based Access Control are a powerful defensive tool if used properly. By using RBAC throughout their enterprise network and mapping roles to business use cases, an organization can dramatically decrease their vulnerability to an expensive and damaging data breach or other cybersecurity incidents.