If a senior staff got authority to makes changes in the financial records of an organization so can take the money out from the organization which is operated by junior staffs. can RBAC be implemented to stop this?

1 Answer 1


RBAC cannot directly stop a user from doing something evil if the user must be able to do an action with the potential for evil as part of the his job function. For example, if the senior staff member does have the need to move around money with junior staff budgets because he fixes allocations between the junior staff members - then he could very likely as easily move the money to benefit himself in some nefarious way, since moving money is a pretty powerful tool.

Common forms of protection that DO use RBAC are a bit more subtle than just "don't let him do it".

Solution 1 - 2 Man Control

One solution that can work is to separate the work up into duties so that several people would have to conspire to commit fraud. For example, give Sr. Executive the right to move money, but not create accounts. Make account creation w/in the purview of a different team or a bigger boss who can't also move money. Now the Sr. Staff can move money, but not to a personal account.

Solution 2 - Approval Required

Another similar approach would be to require approval of transactions. Sometimes there's a dedicated group of approvers who can't also initiate the transaction. And other times it's just that another person w. the same privilege is required to peer review the work.

Solution 3 - Job Rotation

Make the senior staff take a vacation every year. During that time, remove the role from his account and put it on someone else's (his alternate) - let his alternate get access to EVERYTHING (including logs), and let the person do a review of the senior staff's behavior.

Solution 4 - Auditing

Create a separate role of auditors who see the history of all transactions. Make them review the senior's actions and make sure nothing inappropriate happens.

Make sure that senior does not have write/delete access to these audit logs, so he can't change them. Put business logic in place to make sure that the audit role cannot be connected to any other role with change access in the system.

Those are the classics.

1 & 2 prevent the misuse of privileges.

3 & 4 track whether misuse ever occurs, the deterrent becomes the severity of the penalty

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.