Role Based Access Control (RBAC) should be preferred by organizations for assigning and managing user rights and privileges.
Control Type: Technical
Control Function: Preventive
Role Based Access Control (RBAC) has become the standard, default access control method for modern information systems due to its usability and organizational efficiency. In an RBAC scheme, roles are created that map directly to the real-world jobs and tasks that employees are authorized to perform. Each role is then granted specific privileges that grant them access to assets required for them to perform their job. These privileges include specific permissions for reading, writing, or modifying data and other resources. Users can be assigned to multiple different roles at once. For example, Employee A is hired as a database administrator for XYZ Corporation. As part of their provisioning process, User A’s user account is assigned the following roles:
- Database Creator
- Database Editor
- Database Backup Operator
Each of these roles has been carefully provisioned by IT staff with the following privileges:
- Database Creator = can create schemas, tables, and attributes on the organization’s three MySQL servers.
- Database Editor = can modify, add, and delete values and records in databases created by or inherited by the user
- Database Backup Operator = can imitate backups of database schemas and access basic backup options on the organization’s designated file server for database backups
When a user ends up changing roles or leaving the organization, the roles are simply unassigned from their user account, removing all privileges they had and all permissions on applicable resources.
RBAC is usually the default access control model for modern cloud IAM platforms, such as AWS IAM and Microsoft Entra ID. Administrators can customize roles on granular levels and have a single point of reference for all privileges currently assigned on the organization’s cloud assets. RBAC can also be implemented on local Windows networks, which traditionally have used Discretionary Access Control (DAC). This is done by adding domain user accounts to Role Groups (named after the specific organizational roles being applied), then nesting said role groups inside Domain Groups tied to specific privileges. This takes a bit more effort for administrators to set up, but it pays dividends by better organizing user groups and associated privileges.
When organizations implement RBAC, it is important that they regularly audit and review each role and its associated privileges and permissions. Privilege creep is a common problem in organizations, occurring when users accumulate excessive privileges overtime, leaving them with access they don’t need and shouldn’t have because of role changes and organizational reorganization. To address privilege creep, organizations should thoroughly document every user, role, and privilege in their IAM systems, and hold regular meetings with information security staff, business unit managers, and high level leadership to reassess the necessity of each role assignment and associated privilege mapping.
