A dynamic, data-centric approach is key to securing sensitive information and achieving compliance in our modern world of hybrid IT solutions, but what are the differences between RBAC and ABAC, the two common access control approaches?
Over the last two years, companies have seen an expedited shift away from using traditional methods to access their data. With more employees working remotely, we find the security controls we have spent years refining are no longer adequate. It is time for organizations to review their data security practices and decide if a modern approach is required.
When it comes to access control, there are two common approaches an organization can deploy: role-based access control (RBAC) and attribute-based access control (ABAC). Understanding the differences between the two, and common misconceptions, is important ensuring you pick the right technology to match your current needs and a solution that will grow with your organization.
What is RBAC vs ABAC?
Role-based access control (RBAC)
RBAC is a methodology that authorizes a user based on their role. With RBAC, an IT administrator sets the parameters of access a role should have. So depending on your position in the organization, you will have specific access permissions. Other roles will have different access.
It is possible with RBAC for a user to be assigned multiple roles and have access to multiple files or data. For example, a team could be working on a joint project. The project manager will access contracts and edit the project plan. Meanwhile, the development team will only be allowed access to the programming files and won’t be able to access or modify the financial information or contract details for the project. Elsewhere, the HR team has access to all employee and financial data, but cannot use the programming files.
Attribute-Based Access Control (ABAC)
ABAC is a policy-based approach that utilizes properties called attributes. These attributes will include the user credentials, environment, and file properties. This method allows for a more dynamic access control than RBAC. The user’s properties will include their name, department, and security clearance. The environmental properties may consist of the time of access, location of the user and device that they are accessing the network on. Finally, the file’s properties, such as the file name, folder location, author, sensitivity labels and more.
ABAC is implemented to reduce risk and prevent unauthorized access by matching the condition of a user and the data to grant or deny access to the file. For example, instead of the project manager always being able to modify contract files from any device in any location, ABAC will limit exposure by restricting to only office hours and locations or encrypting the document when accessed from an unprotected mobile device. Implementing ABAC can reduce security issues and help with compliance and auditing processes. As ABAC considers the role of the user accessing the data, RBAC will also have a part to play in the policy rules.
RBAC vs ABAC Myths that need busting
It’s hard to overstate the need for access control in a modern working environment. Data breaches cost organizations millions of dollars every year, and many of these breaches can be avoided by employing better access control. So why are companies not choosing to implement a more dynamic approach to their data access controls with ABAC vs RBAC?
The problem is many organizations consider ABAC to be a complicated solution that requires additional time, budget and resources to manage. This is simply not true and we will bust some of those misconceptions below.
Myth 1 – It takes more time to implement ABAC vs RBAC
When setting up an ABAC access policy, there are many variables that can be added to a rule. Most organizations will want to put some planning in before applying advanced workflows. However, this granularity only needs to be applied at the latter stages of ABAC implementation. Mature ABAC providers will have many everyday use cases ready to go, out of the box. As ABAC can utilize an established RBAC policy, most of these rules will only require minor modifications to extend existing rulesets.
Myth 2 – ABAC is complex
Have you ever created an Outlook rule in your inbox? ABAC policies are just as easy to set up. For example, a dynamic access policy asks three questions:
- What is the role of the user accessing the document?
- Does the file contain sensitive data?
- What are the conditions of the users’ access?
Taking our example from earlier in this article, a Project manager (1) is attempting to access a contract (2) document from their company laptop (3) then ABAC grants access. However, if the manager is now accessing the same document from their mobile device while connected to public WiFi, ABAC will deny access. The one ABAC rule can apply appropriate controls to multiple access attempts. Therefore, there is no need to complicate an access policy.
Myth 3 – ABAC requires expertise
The example above demonstrates that you don’t need to be an expert to implement robust access controls. The ABAC methodology ensures secure information access and sharing across an organization is manageable with the right tools.
Myth 4 – ABAC only suits larger organizations
Another key advantage of ABAC is that it is scalable and will grow with your company. A small organization of 50-100 users is just as vulnerable to data breaches as a company of 10,000 users. Many of these larger companies also suffer from legacy RBAC implementations that have not been adapted over time as the company grew. Even a mid-sized IT infrastructure can be filled with empty security groups, employees that change roles and leave the organization but still have access to critical assets. Cleaning up access can be a full-time job and requires knowledge of the business needs and the needs of the employees. ABAC grows with your users and will protect your data accessed inside the office and outside of your security perimeter.
Myth 5 – ABAC is heavy on IT resources
Early iterations of ABAC relied on agent-based enforcement. The software had to be running on an employee’s desktop to enforce rules and protect data, but in the modern working environment, this is no longer required. Agentless, service-based implementations allow companies to seamlessly transition their workforce to ABAC without the need for additional software to take up memory and hard-drive space on their laptops. In fact, in a world where we can read documents from our phones, tablets, TVs and even watches, a seamless agentless solution is needed more than ever!
Enhancing Zero Trust with ABAC
Now more than ever, information security is at the forefront of data security experts. The pandemic has brought a massive shift to how we work with our data, whether accessing from home environments, personal devices or using collaboration platforms such as SharePoint and M365. In addition, organizations are producing content at a prolific rate, and this data is now accessible inside and outside the secure perimeter. With these changes, the concept of “Zero Trust” is quickly gaining attention as the preferred security methodology. Zero Trust boils down to a simple concept: verify and validate every access attempt to data to satisfy the needs of the user and the business.
Using a data-centric zero-trust security approach enforced by ABAC ensures that appropriate validation is applied. The rules are relevant to the sensitivity of the data – in the context of whatever the access or sharing scenario is.
The Practical Implementation of ABAC
With NC Protect from archTIS, organizations can quickly implement ABAC to effectively manage data protection on-premise, files shared via email and apply control to content accessible in M365, SharePoint and other file shares. NC Protect applies and enforces dynamic, policy-driven access controls that leverage both user and data attributes to ensure your users and partners access, share and collaborate on sensitive and classified information — securely.
NC Protect applies real-time ABAC-powered access, usage and protection policies to unstructured data. Whether the information is stored in a document or shared in a chat log, companies can enforce what a user can see when browsing or searching for files with dynamic access controls. When a user is granted access, it can be restricted to read-only versions using a secure application that also applies dynamic watermarks to identify the user and device used to open the file. A user may also be granted full control, but their activity is recorded in an audit trail that captures who accessed what, when and where, across the entire organization.
NC Protect is simple to deploy, and it does not change the state of your data at rest. It can utilize existing RBAC policies to ensure faster onboarding and expand to ensure your employees only have access to content that they require. The platform will also consume metadata applied by other security applications, ensuring existing security policies are easily transitioned to a more dynamic access policy.
If you are considering implementing ABAC to enforce a zero trust policy, consider NC Protect. Whether you need to manage sensitive data securely within your Microsoft 365 applications (SharePoint, Office and Exchange), SharePoint Server or Windows file shares or need managing access and sharing of classified information stored with high levels of assurance – archTIS can assist. archTIS puts you on the path to zero trust access and protection with immediate benefit and return on investment, while enabling your big picture goals.
