Cyberstudy
PDF p.93 In progress

Role- and Attribute-Based Access Control

Open PDF at p.93 15 flashcards

Summary

PDF p.93

Role-based access control (RBAC) and attribute-based access control (ABAC) use nondiscretionary, rules-based permissions assignments, offering more flexibility than mandatory access control (MAC). RBAC assigns permissions based on roles, while ABAC uses a combination of attributes to make access decisions.

In plain words

Supplementary — not from your PDF

Role-based access control (RBAC) gives permissions to roles (like 'Payroll Clerk') and puts people in roles. Attribute-based access control (ABAC) decides using many attributes at once: who you are, which device, where from, whether it's patched.

Detailed explanation

PDF p.93
  • Role-Based Access Control (RBAC)
    • Definition: Permissions are defined based on tasks that employees or services must perform. Each set of permissions is a role, and users or services (principals) are assigned to one or more roles.
    • Nondiscretionary: Only system owners can modify role permissions, not the principals themselves.
    • Implicit Rights: Principals gain rights through role assignments rather than direct permissions.
    • Security Groups: User accounts are assigned to security groups, which are then assigned permissions. This approach can be applied across different operating systems for flexibility and scalability.
    • Implementation: RBAC can be partially implemented by mapping security groups to roles, but they are not identical. Administrators should not be able to arbitrarily assign roles to their own accounts or boost role permissions.
  • Attribute-Based Access Control (ABAC)
    • Definition: Access decisions are based on a combination of subject and object attributes, plus any context-sensitive or system-wide attributes.
    • Attributes: Can include group/role memberships, OS information, IP address, presence of patches and antimalware, and more.
    • Monitoring: Tracks events, alerts, and access requests to ensure consistency in timing and location.
    • Policies: Can implement policies like M-of-N control (requiring a minimum number of agents to perform a task) and separation of duties.

Important terms

taken from the text above
Role-Based Access Control (RBAC)
Permissions are defined based on tasks that employees or services must perform. Each set of permissions is a role, and users or services (principals) are assigned to one or more roles.
Nondiscretionary
Only system owners can modify role permissions, not the principals themselves.
Implicit Rights
Principals gain rights through role assignments rather than direct permissions.
Security Groups
User accounts are assigned to security groups, which are then assigned permissions. This approach can be applied across different operating systems for flexibility and scalability.
Attribute-Based Access Control (ABAC)
Access decisions are based on a combination of subject and object attributes, plus any context-sensitive or system-wide attributes.
Policies
Can implement policies like M-of-N control (requiring a minimum number of agents to perform a task) and separation of duties.
RBAC Role-based access control ABAC Attribute-Based Access Control

Examples & real-world scenarios

Supplementary — not from your PDF
  • RBAC: everyone in the 'Nurse' role can view patient charts.
  • ABAC: allow only from a managed device, on the office network, during a shift.
  • Security groups used to put RBAC into practice.

Scenario

A hospital wants nurses to open records only on hospital-managed tablets inside the building. A role alone can't express that; ABAC can combine role, device and location.

Common mistakes

Supplementary — not from your PDF
  • Assuming security groups and roles are exactly the same thing. They're related but not identical.
  • Giving people permissions directly instead of through roles, which gets messy quickly.

Practical skills

Supplementary — not from your PDF
  • Turn a job description into an RBAC role, or an access rule into ABAC attributes.

What I should remember

Key Points PDF p.93
  • Role-Based Access Control (RBAC)
    • Permissions: Defined by roles based on tasks.
    • Nondiscretionary: System owners control role permissions.
    • Implicit Rights: Gained through role assignments.
    • Security Groups: Used for flexible and scalable permissions management.
    • Implementation: Mapping security groups to roles, avoiding privilege escalation.
  • Attribute-Based Access Control (ABAC)
    • Access Decisions: Based on a combination of attributes.
    • Attributes: Include group memberships, OS, IP address, patches, etc.
    • Monitoring: Tracks events and access requests.
    • Policies: Supports M-of-N control and separation of duties.