Role-based access control (RBAC) vs. Attribute-based access control (ABAC)

Access Control

Access control answers two questions:

• Authentication: Who are you?
• Authorization: What are you allowed to do?

The video focuses on two authorization models: role-based access control and attribute-based access control.

Authorization Models

Role-Based Access Control (RBAC)

In RBAC, permissions are assigned to organizational roles, and users are assigned to the roles they perform.

For example, in a hospital:

• Doctors can write and read orders and read lab reports.
• Nurses can read orders and lab reports.
• Lab technicians can write and read lab reports.

RBAC reduces the complexity of assigning permissions to individuals. It also makes it easier to add users or update permissions by changing role assignments or role definitions.

Attribute-Based Access Control (ABAC)

In ABAC, access depends on attributes associated with the user or request. Attributes might include department, job position, employment status, location, manager status, or security clearance.

For example, access to sensitive financial information might require a user to have high security clearance, be a manager, and work in Finance.

Choosing an Approach

Neither model is universally better:

• RBAC can suit organizations with clear hierarchies and well-defined roles.
• ABAC can provide more flexibility in dynamic or less hierarchical environments.

Either model can become complicated. Organizations can also combine them—for example, using a role to assign a high-level attribute.

Access-Control Architecture

A policy enforcement point (PEP) mediates a user’s request for a resource. A policy decision point (PDP) decides whether access should be granted, and the PEP enforces that decision.

RBAC, ABAC, or a hybrid approach can inform the decision.

Speaker and Source

Jeff Crume, IBM Distinguished Engineer and Adjunct Professor; IBM Technology.