Role-Based Access Control (Hardcover)

~ David F. Ferraiolo (Author), D. Richard Kuhn (Author), Ramaswamy Chandramouli (Author) "Access control-or authorization, in its broadest sense-has existed as a concept for as long as humans have had assets worth protecting..." (more)
Key Phrases: supporting system functions, limited role hierarchies, target system platforms, John Smith, Payroll Admin, Adjustment Admin (more...)

Editorial Reviews

Product Description

Text covers all aspects of role-based access control (RBAC). Explains details of the RBAC model and how to use it to emulate other access control models. Covers the frameworks and tools for administering RBAC. For software developers, security administrators, and students. Includes index and references. DLC: Computers--Access control.

About the Author

David F. Ferraiolo is a supervisory computer scientist in the Computer Security Division at the National Institute of Standards and Technology (NIST), Gaithersburg, MD. In addition to managing three access control and security management projects, he is leading research to improve operational assurance, security authentication, intrusion detection, and authorization.

D. Richard Kuhn is a computer scientist in the Computer Security Division of NIST. His primary technical interests are information security and software testing and assurance. He developed, in conjunction with David Ferraiolo, the first formal model for role based access control, and is overseeing NIST's proposed standard for RBAC.

Ramaswamy Chandramouli is a computer scientist in the Computer Security Division of NIST. He has more than 17 years experience in design and development of IT solutions in industry and government, and coauthored the first international security protection profile for RBAC. His current work focuses on automated security testing tools, and he is coauthor of NIST's proposed RBAC standard. --This text refers to an alternate Hardcover edition.

Product Details

• Hardcover: 338 pages
• Publisher: Artech House Publishers; illustrated edition edition (April 2003)
• Language: English
• ISBN-10: 1580533701
• ISBN-13: 978-1580533706
• Product Dimensions: 8.8 x 7.2 x 1.2 inches
• Shipping Weight: 1.7 pounds
• Average Customer Review: 3.0 out of 5 stars  See all reviews (4 customer reviews)
• Amazon.com Sales Rank: #1,349,949 in Books (See Bestsellers in Books)

Customer Reviews

Most Helpful Customer Reviews

21 of 23 people found the following review helpful:

5.0 out of 5 stars Most complete RBAC reference, July 11, 2004

By	Mike Tarrani "www.tarrani.com" (Deltona, FL USA) - See all my reviews (TOP 500 REVIEWER)    (REAL NAME)    (COMMUNITY FORUM 04)

The three authors are leaders in RBAC research and development, making this book one of the most authoritative and complete references to RBAC.

Chapters 1 through 3 give a solid foundation for understanding RBAC and how it evolved, starting with an introduction, an exhaustive survey of access control methods needed to fully understand the evolution, and a solid and detailed overview of RBAC itself.

In the subsequent chapters each aspect of RBAC is covered in depth. Topics include role hierarchies, separation of duty policies, administration, integrating RBAC into existing infrastructures, and migration to RBAC. In addition, there are chapters on related topics that give this book wide scope - "Using RBAC to Implement Military Policies" shows how to implement multi-level security models with RBAC. This information uses military policies, but the material is also of interest to any commercial organization seeking tightly integrated access controls and a high security posture. The chapter on the proposed NIST RBAC standard also covers key items of interest, including Common Criteria RBAC protection profiles and other conformance issues. There are also chapters on RBAC research and prototypes, and commercial products.

While this book is well written and uses illustrations to impart key concepts, you will need to be conversant with set theory in order to get the most from it, as well as understand RBAC itself. If you are a bit rusty I recommend refreshing your skills before diving into this book.

If you want to explore RBAC and the work of each of the authors visit NIST Computer Security Division and Computer Security Research by pasting the ASIN, B0001O48Y4, into the search box, selecting all products and clicking GO. Once you are on the site you'll find the RBAC section under Security Research/Emerging Technologies->Authorization Management and Advanced Access Control Models (AM&AACM) link.

3 of 3 people found the following review helpful:

3.0 out of 5 stars Useful but difficult, August 19, 2007

By	Rob van der Staaij (Netherlands) - See all my reviews

Overall, this is a very comprehensive book that covers almost all aspects of RBAC.

What strikes me the most when reading this book, is the academic and theoretical nature of its contents. For example, the diagrams and especially the formulas, which are used to illustrate things, are likely difficult to grasp for a non-expert and will probably not elucidate the discussions in an average RBAC project. Since RBAC affects many different people in the organization, from business to IT, the subject should be presented as straightforward and simple as possible.

The book starts with a, useful, overview of access control. The different types, such as DAC `Discretionary Access Control' and MAC `Mandatory Access Control', are explained and compared with RBAC.
In one of the subsequent chapters the authors discuss how RBAC can be combined with other access control mechanisms. But the theoretical nature of the book is exemplified at the end of one of the discussions when it is stated that `To date, systems supporting both MAC and RBAC have not been produced, but the approaches discussed in this chapter show that such a system is possible.'

One of the most important chapters in my view is the one that deals with SOD `Segregation (or Separation) Of Duties'. SOD is an effective means to combat fraud.
Also useful, however brief, is the chapter, in which the authors discuss how RBAC can be used in regulatory compliance.

Throughout the book a number of frameworks, techniques and mechanisms are described how to integrate RBAC in real life environments. In the last chapter four arbitrarly chosen provisioning products (here called enterprise security administration products) are discussed, most of which, however, only offer moderate support for role modeling and RBAC administration. The products that do offer such support in a much better way, such as those from Bridgestream (now Oracle), Eurikify, BHOLD and Vaau (now Sun Microsystems), are surprisingly enough not mentioned at all.

What also is missing is a comparison of job functions and RBAC roles. Many people ask themselves how these relate to or differ from each other.

The examples, which are used, are almost exclusively from financial and health care organizations. Examples from government organizations as well as from educational institutes and production environments would have been helpful as well, since these kinds of organizations have their own unique RBAC requirements.

Rob van der Staaij

5 of 7 people found the following review helpful:

3.0 out of 5 stars Role base management process, December 14, 2006

By	I. Sharoni (NY,USA) - See all my reviews (REAL NAME)

Hi

I am a consultant and analyst of role base projects and this book lays out the foundations of RBAC model.
i would like to add:
There are few ways to start a role base project. It depends on factors as # of users, # of systems , # of security Admins , budget, auditors, company needs and more.



Usually, companies are trying to approach this project, using the current resources and do this project manually, without any external consultancy or experience, best practices and methodologies

By taking the manual approach, you can generate few roles, usually, the basic enterprise roles or departmental roles, but then , you will find that you need to generate many other roles, by analyzing many users, resources , access rights and working and interviewing with many business managers, a process that can take 24-48 months for an organization with 10k users.



I have been managing 10-15 RBAC projects and involved in about 50 others, in USA & Europe, and I can share with you the high level best practices.





Cleansing

1. Mapping the company systems, and business model.

2. Set the RBAC targets - # of roles, workflows etc

3. Import current access rights and perform a mini cleansing project - 3-4 weeks

4. Doing role engineering on very polluted data, will product roles, but vary dirty roles.

5. It is better to spend few weeks on cleansing till you feel that you managed to clean the major faulty access rights

6. Use smart AUDIT tools to analyze your current access rights model and advice you what access rights are suspected

7. Use compliance and policy check tools (Segregation of duty etc) to perform the cleansing

8. Use a workflow for Access-Rights Certification - (example Eurekify/Sage)



Role Engineering:

Use tools that can help you creating roles by analyzing your current access right. There are few tools in the market as Eurekify/Sage.
Run all the techniques that this tool provide and analyze the results.
Use a tool that has a built in workflow for Role Approval
Audit your roles and make sure that the roles are normalized
highly recommended to use automated solutions to audit your roles
Build compliance rules to validate the roles.
and more..


Role Management

Ensure that you will be able to modify and alter the roles easily
build or use a solution that will help you to manage and maintain the roles
keep in mind that roles are dynamic and will change


Role certification / re -certification

Make sure that you have a workflow to certify / recertify roles
record and archive all the changes
Build reports that will help you to manage and control your roles and results.


Hope it helps



Best Regards

Ilan Sharoni

Director - Eurekify