Role-based access control (RBAC)

Role-based access control (RBAC) is a method of restricting network access based on the roles of individual users within an enterprise. RBAC lets employees have access rights only to the information they need to do their jobs and prevents them from accessing information that doesn't pertain to them.

An employee's role in an organization determines the permissions that individual is granted and ensures that lower-level employees can't access sensitive information or perform high-level tasks.

In the role-based access control data model, roles are based on several factors, including authorization, responsibility and job competency. As such, companies can designate whether a user is an end user, an administrator or a specialist user. In addition, access to computer resources can be limited to specific tasks, such as the ability to view, create or modify files.

Limiting network access is important for organizations that have many workers, employ contractors or permit access to third parties, like customers and vendors, making it difficult to monitor network access effectively. Companies that depend on RBAC are better able to secure their sensitive data and critical applications.

Benefits of RBAC

There are a number of benefits to using RBAC to restrict unnecessary network access based on people's roles within an organization, including:

• Improving operational efficiency. With RBAC, companies can decrease the need for paperwork and password changes when they hire new employees or switch the roles of existing employees. RBAC lets organizations quickly add and change roles, as well as implement them across platforms, operating systems (OSes) and applications. It also cuts down on the potential for error when user permissions are being assigned. Additionally, with RBAC, companies can more easily integrate third-party users into their networks by giving them predefined roles.
• Enhancing compliance. Every organization must comply with local, state and federal regulations. Companies generally prefer to implement RBAC systems to meet the regulatory and statutory requirements for confidentiality and privacy because executives and IT departments can more effectively manage how the data is accessed and used. This is particularly important for financial institutions and healthcare companies that manage sensitive data.
• Giving administrators increased visibility. RBAC gives network administrators and managers more visibility and oversight into the business, while also guaranteeing that authorized users and guests on the system are only given access to what they need to do their jobs.
• Reducing costs. By not allowing user access to certain processes and applications, companies may conserve or more cost-effectively use resources, such as network bandwidth, memory and storage.
• Decreasing risk of breaches and data leakage. Implementing RBAC means restricting access to sensitive information, thus reducing the potential for data breaches or data leakage.

Best practices for role-based access control implementations

There are a number of best practices organizations should follow for implementing RBAC, including:

• Determine the resources for which they need to control access, if they're not already listed -- for instance, customer databases, email systems and contact management systems.
• Analyze the workforce, and establish roles that have the same access needs. However, don't create too many roles because that would defeat the purpose of role-based access control and create user-based access control rather than role-based access control. For instance, there could be a basic user role that includes the access every employee needs, such as to email and the corporate intranet. Another role could be that of a customer service representative who would have read/write access to the customer database, and yet another role could be that of a customer database admin with full control of the customer database.
• After creating a list of roles and their access rights, align the employees to those roles, and set their access.
• Evaluate how roles can be changed, as well as how accounts for employees who are leaving the company can be terminated and how new employees can be registered.
• Ensure RBAC is integrated across all systems throughout the company.
• Conduct training so that the employees understand the principles of RBAC.
• Periodically conduct audits of the roles, the employees who are assigned to them and the access that's permitted for each role. If a role is found to have unnecessary access to a certain system, change the role, and modify the access level for those individuals who are in that role.

RBAC vs ABAC

Role-based access control and attribute-based access control (ABAC) are both types of access control methods, but their approaches are different.

While RBAC grants access rights depending on the roles of users, ABAC controls access based on a combination of attributes, i.e., user attributes, resource attributes, attributes associated with the system or application to be accessed and environmental attributes.

User attributes may include name, nationality, organization, ID, role, security clearance and so on. Examples of resource attributes include owner, name, data creation date and so on, while environmental attributes include access location, time of access and threat levels.

In addition to simplifying access management, ABAC enables companies to reduce risks due to unauthorized access and helps to centralize auditing.

Organizations should use RBAC for coarse-grained access control, such as giving all professors in a university access to Google for doing research or giving all contractors access to corporate email. On the other hand, companies should use ABAC for fine-grained access control or if they need to make decisions under specific conditions, e.g., giving professors access to Google only if they work in building X and teach freshman classes.