Timeline for Role-Based Access Control Disadvantages
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 21, 2021 at 17:21 | comment | added | David Brossard | I don't understand the downvotes here... | |
| Feb 15, 2017 at 15:14 | comment | added | David Brossard | Runtime dynamic and standardized | |
| Feb 15, 2017 at 14:49 | comment | added | Jacco | I don't know what your definition of dynamic SoD is, but it is part of the NIST standard and many implementations support it. | |
| Feb 15, 2017 at 13:59 | comment | added | David Brossard | @Jacco RBAC does not include dynamic SoD. It is a fallacy to claim so. I know lots of papers write it but it is just not true. We have so many instances of customers failing on SoD because of dynamic SoD rules. Standardized is not applicable to RBAC. It has a model but no implementation language. Externalized is not entirely true of RBAC because it only externalize role management and role assignment but not the actual authorization logic which you still have to write in code. | |
| Feb 15, 2017 at 8:51 | comment | added | Jacco | Also, the first four (Externalized, Centralized, Standardized & Flexible) characteristics you mention for ABAC are equally applicable and the fifth (Dynamic) is partially applicable to RBAC. The context-based part is what sets ABAC appart from RBAC, but this comes at the cost of severely hampering auditability. | |
| Feb 15, 2017 at 8:45 | comment | added | Jacco | RBAC does include dynamic SOD (separation of duty). | |
| Feb 14, 2017 at 22:20 | history | answered | David Brossard | CC BY-SA 3.0 |