What is RBAC?
Role-Based Access Control (RBAC) is the model and practice of restricting network access based on the roles of individual users across the enterprise. RBAC gives employees access rights only to the information they need to accomplish their assigned tasks based on their job role and prevents them from accessing information that is not relevant to them or necessary to complete their tasks.
The employee's role determines the permissions they are granted and ensures that specific categories of employees cannot access sensitive information or perform tasks that provide a gateway to confidential data.
Roles are based on several elements in RBAC, including authorization, responsibility, and job specialization. Organizations typically designate roles for various users, such as an end user, an administrator, or a specialist user. The capability to view, create or modify files within a role may also be limited for specific tasks.
Whenever employees change jobs or positions within an organization, their access will need to be changed accordingly. When adding a user to an existing role group, the individual user will gain access to all the permissions granted to that group. If they are removed from the group for any reason, their access will be restricted. RBAC allows users to be assigned temporary access to specific data or programs they might need to complete a specific task.
Cybersecurity for Dummies
Larger organizations with hundreds or even thousands of workers, contractors, and third parties, including customers and vendors, must control access to their networks to safeguard critical information and systems. RBAC provides an important tool these organizations use to monitor and control access to their most confidential data and critical applications.
What are some examples of RBAC?
Implementing RBAC allows IT security teams to control what end users can do at all levels of the organization, from the board of directors to the call center customer service manager. RBAC usually classifies users into two major categories: an administrator or a standard user. Roles and permissions are then assigned and aligned according to the user's specific position in the organization.
Following the principle of least privilege, users should be provided with only enough access for that individual employee to do their job.
Here are some typical examples of where RBAC controls access for specific roles/positions.
- An employee in the finance department would like access to the accounting or payroll system such as Xero and/or ADP
- Software engineer roles could be assigned access to the Google Cloud Platform, Amazon Web Services, or GitHub
- The human resources director would be assigned access to Oracle HCM or Zenefits.
- Marketing directors may be assigned access to a marketing automation system such as Marketo and Google Analytics or manage Facebook ads and Google pay-per-click accounts.
RBAC software tools typically feature a management tier and an individual contributor tier with different permission levels inside the individual applications granted to each role.
What are the benefits of RBAC?
RBAC benefits include:
Minimize the risk of data breaches - Implementing RBAC not only reduces the risk of cyber threats and abuse by malicious insiders, but it can also be crucial in limiting the damage from an attacker who has compromised an employee's user credentials.
Demonstrate and enforce compliance - As regulations continue to grow at every level of government from the Federal level to state and industry-specific mandates, RBAC helps organizations meet regulatory and statutory requirements. Financial institutions and healthcare companies are under significant pressure to show how they use, manage, and protect sensitive data.
Improve operational productivity and efficiency – RBAC enables organizations to reduce paperwork and password change requests when hiring and onboarding new employees or switching roles for existing employees. With RBAC, you automate the process to quickly add and change roles and put them into effect across platforms, operating systems (OS), and applications. You also reduce the potential for human error when user permissions are assigned. RBAC also makes the process of integrating third-party users more secure by giving them strictly defined roles and permissions.
Provide greater visibility for administrators - RBAC gives network administrators and managers more visibility and oversight into the business while also guaranteeing that authorized users and guests on the system are only given access to what they need to do their jobs.
Conserve resources - Restricting user access to specific processes and applications conserves network resources and keeps employees focused on the task at hand.
Implementing RBAC
Implementing RBAC is best accomplished with a methodical approach that emphasizes doing the work upfront to understand your IT environment and the relationships
The first step is always defining and determining the resources and information that need to be controlled with proper access. That typically includes customer databases, employee information, financial records, and intellectual property. You don't have to cover all the bases initially. Start with those areas of most sensitive information.
Next, you want to analyze the functions and relationships in your workforce to establish roles that have common access criteria. Don't go overboard in creating too many roles. The goal is to logically group user-based access control into basic categories such as access that every employee might need, including email and access to the corporate intranet. Customer service representatives might also suggest a role that grants read/write-only access to the customer database. Other roles can be elevated to define a customer database admin as having full control of the customer database.
Once you have established the roles that make sense for your organization, you can match the proper access rights to the roles and then align them to those roles to determine their access.
Make sure your RBAC implementation takes into account how roles can be changed for users, along with provisioning new employees and terminating access when an employee leaves the company.
You may want to conduct training sessions to help employees understand the principles of RBAC and the security and other benefits gained by adopting RBAC.
Finally, you'll want to conduct periodic audits of your roles, including the type of assigned users and the access that's permitted for each role. If you discover that a role has unnecessary access to a specific system, you may want to change how you define and assign the role and modify access levels for those users in that role.
More RBAC Resources:
Blogs
Role-Based Access Control for a Complex Enterprise
Access Control: Models and Methods
Products
Control User Rights and Privileges with Secret Server
RBAC in Secret Server
What does cybersecurity like this cost? Not as much as you think