13
votes
RBAC0 RBAC1 RBAC2 RBAC3 -- What do they mean?
These are 'levels' for the NIST RBAC Model, as described in: The NIST Model for Role-Based Access Control: Towards a Unified Standard.(pdf)
They respectively refer to:
Flat RBAC
Hierarchical RBAC
...
- 7,602
8
votes
Role-Based Access Control Disadvantages
The main disadvantage of RBAC is what is most often called the 'role explosion': due to the increasing number of different (real world) roles (sometimes differences are only very minor) you need an ...
- 7,602
8
votes
Accepted
Rights vs permissions vs privileges
Role Based Access Control is a well defined model, that comes with its own terminology. At minimum, RBAC has the following entities:
A User has one or more Roles.
A Role is a collection of Permissions....
- 7,602
5
votes
MAC vs DAC vs RBAC
Each system is used for a different overriding security requirement. The three main security requirements are confidentiality, integrity, and availability.
MAC supports a security requirement of ...
- 71
4
votes
Handling User Permissions Between Front-end and Back-end
I am less used to angular frontends, but this as always been a question: should the control of user permissions be done client-side or server-side?
The answer was (and IMHO still is) that client side ...
- 26.1k
4
votes
Explain the concept of RBAC to limit the right of senior staff
RBAC cannot directly stop a user from doing something evil if the user must be able to do an action with the potential for evil as part of the his job function. For example, if the senior staff ...
- 11.7k
3
votes
Microservices and RBAC using OIDC
ID token and Access Token serve two different purposes in OIDC.
ID Token = For ascertaining Identity of the user. Who the user is? What is their email address?
Access Token = For ascertaining if the ...
- 452
3
votes
Separating "function" from "scope" in RBAC
While role-based access control (RBAC) is a major model for managing the authorizations,
implementing RBAC has some limitations and consequences.
One of the consequences is role explosion, where ...
- 1,256
3
votes
Accepted
Separation of Duties using RBAC
Quoting this SANS article:
Static Separation of Duties defines role memberships that are mutually exclusive. For example, RBAC can ensure that users cannot be members of both the purchasing role and ...
- 3,592
2
votes
What are the security implications of having a dummy user account representing unauthenticated users?
It sounds like your following good security principles by establishing secure defaults, trying to keep it simple, and ensuring guests have least privilege.
I think both of the two options are viable ...
2
votes
Separation of Duties using RBAC
What they are referring to is a rule-set that is either extremely rigid, in the case of static, or a little more malleable, as is the case with dynamic.
I will use the article's example to explain a ...
- 3,987
2
votes
Accepted
RBAC: how to separately scope two resources that have a many-to-many relationship
Your data model looks like a graph. Contact --- assigned to --- File, and vice versa. So the assignments are links (edges) in the graph.
I am assuming that there can also be multiple contacts ...
- 452
2
votes
Is it ok to send roles and permissions data to the browser in a RBAC system?
It's fine as long as it's for convenience only and does not serve a security function. And if exposing that information does not create a vulnerability in your system.
Anything you send to the client ...
- 127k
2
votes
Is it good or bad to use group in sudoers file instead of using aliases?
Using groups for sudoers entries allows you to manage filesystem permissions (which by default are user- and group-based) in the same place as sudo rules. Using User_Alias instead of groups means all ...
- 1,345
2
votes
Accepted
Why has the adoption of ABAC been so slow?
Seems there's a 3rd and 4th reason why the adoption of ABAC has been so slow: tricky to implement properly and high maintenance.
From this site:
Setting up a system as complex as ABAC could take ...
- 140
1
vote
Should access control be managed from inside application?
As always: it depends. It depends, for example, on your relation with the users. Are they from your company or are they clients?
If the users are not from your own company, you will want to separate ...
- 2,027
1
vote
Is using EXECUTE AS impersonation for user authentication in a web application a good idea?
Here are a few reasons why using EXECUTE as might be a worse idea:
If the web application has SQL injection flaws the attacker could alter their privileges.
If the web application has a vulnerability ...
- 5,889
1
vote
How to design an Access Control system that is quick to implement and understand, yet maintainable and flexible enough?
Background
The other comments and answers as well as your post point you in the right direction. You need a framework that is flexible enough to address your current authorization needs as well as ...
- 1,395
1
vote
Question about access control with RBAC and DAC
It looks to me like the question is asking how many relationships there would be, but you are calculating the maximum number of possible relationships.
there are total of 1250 users and 29 ...
- 15.6k
1
vote
Is It Possible to Implement Rule-Based Access Control on Amazon Web Services?
You mean attribute-based? Yes it is possible. AWS has several ways to do that e.g. AWS IAM which can be used across AWS services. In some cases you can also use resource-based policies (AWS API ...
- 1,395
1
vote
Difference between Non-discretionary and Role-based Access control?
RBAC can be discretionary access control, with anyone in the role granting it to you, or mandatory access, with only the security officer granting the role upon application from a manager.
The ...
1
vote
Implement RBAC for my application
I can suggest the following options based on provided information:
Define data domain (North America, Europe, etc.) according to your criteria and grant roles within that domain only.
E.g., grant ...
- 500
1
vote
RBAC togehter with AAA?
Authentication, authorization, and accounting (AAA) is a term for a framework for controlling access to computer resources, enforcing policies and auditing usage. RBAC (Role Based Access Control) is a ...
- 346
1
vote
Role Based Access Control + Data Ownership based permissions
I realize this question is nearly 4 years old. The answers, especially the one given by userxxxxx, are great.
Since then, a new access control paradigm has matured and addresses the shortcomings of ...
- 1,395
1
vote
Accepted
ABAC policy formulation and RBAC question
Axiomatics provides an authorization policy lifecycle that will help you formulate your ABAC policy.
Define the use case
Define the use case’s authorization requirements in natural language ...
- 1,395
1
vote
If authenticated user tries to access a restricted resource
It is possible to enumerate resources through distinctions such as these - if you return a 403 for pages that do exist, but the current user can't access, and 404 for pages that don't exist, an ...
- 27.3k
1
vote
Securing Java REST Api for Saas usecase
I'll begin by answering with two other questions :
If you roll your own solution, how much time will it take you ?
If your API is public by design, how fast can your developer understand a non-...
- 293
Only top scored, non community-wiki answers of a minimum length are eligible