Question about access control with RBAC and DAC

Question

Here is the problem

A company has 1250 employees and the employees have been trained to handle 4 job duties:

Clerks: 1200 of the employees have been approved to work as clerks. To do their job, a clerk needs a total of 10 different permissions.

Tellers: 100 of the employees have been approved to work as tellers. To their job, a teller needs a total of 9 different permissions.

Managers: 10 employees have been approved to work as managers. To do their job, a manager needs a total of 6 different permissions.

Auditors: 2 employees have been approved to work as auditors. To do their job, an auditor needs a total of 4 different permissions.

So the problem asks for the number of relationship between users and permissions for (1) RBAC and (2) discretionary access control. This is what i have so far:

for DAC, the relationship is a matrix of users vs permission, there are total of 1250 users and 29 permission so the number of relationship I got is 36,250.

for RBAC, we need two matrix, one for users and roles, and one for roles and permission, so basically I did 1250 * 4 (users X roles ) + 29 * 4 (roles X permissions) which gets me 5116.

Are these values correct? or am attempting this problem wrong.

Answer 1

It looks to me like the question is asking how many relationships there would be, but you are calculating the maximum number of possible relationships.

there are total of 1250 users and 29 permission so the number of relationship I got is 36,250.

Each user doesn't need all 29 permissions. 1200 users need 10 permissions, 100 need 9, 10 need 6, and 2 need 4, which is 12968 total.

I did 1250 * 4 (users X roles ) + 29 * 4 (roles X permissions) which gets me 5116.

Since there are more employees listed than there are in the company, some are going to need multiple roles, but every employee isn't going to have every role. 1200 will need a "Clerk" role, 100 will need a "Teller" role, 10 will need a "Manager" role, and 2 will need an "Auditor" role, for 1312 total user-role associations. Additionally, each role will not have all 29 permissions (that would defeat the point), 1 role will have 10, another 9, and 6, and 4, for a total of 29 role-permission associations.

Technically the question doesn't give enough information for an exact answer, as some of the 10 permissions clerks need could overlap with some of the 9 permissions tellers need, and so on. This would slightly reduce the number of associations for the DAC but not the RBAC, as someone who was both a clerk and a teller may need only 13 permissions instead of 19 due to the overlap.