Role-Based Access Control: Core Rules, Extensions, and Trade-offs

All flashcards

What is role-based access control?

RBAC restricts system access by assigning permissions to roles and granting users access through their authorized role assignments.

What are the three primary RBAC rules?

Role assignment requires a subject to have a role; role authorization requires the active role to be authorized for that subject; permission authorization requires the active role to be authorized for the permission being exercised.

What is a role hierarchy?

A role hierarchy is an ordered relationship between roles that supports inheritance. If $x \geq y$, role $x$ inherits the permissions of role $y$.

How do RBAC constraints support separation of duties?

Constraints restrict potentially risky combinations of roles or permissions. They can prevent one person from both performing and authorizing a critical action.

What are the three standardized RBAC levels?

Core RBAC provides the foundational model; Hierarchical RBAC adds role inheritance; Constrained RBAC adds constraints, including support for separation of duties.

Quiz questions

1. In RBAC, how do users generally acquire permissions?Answer: Through assigned roles whose permissions cover requested operations.
2. What does the role authorization rule require?Answer: A subject's active role must be authorized for that subject.
3. In a role hierarchy, what does $x \geq y$ mean?Answer: Role $x$ inherits the permissions of role $y$.
4. Which RBAC feature can prevent one person from creating an account and authorizing its creation?Answer: A constraint that enforces separation of duties.
5. Which standardized RBAC level adds constraints to the hierarchical model?Answer: Constrained RBAC, which adds rules restricting assignments or actions.