Attribute-Based Access Control

What’s the difference between ABAC vs. RBAC? RBAC permits or restricts data access based on the privileges associated with a user’s role within an organization. Privileges can only be changed or added if a new role is created. ABAC is more dynamic. It permits or restricts data access based on a variety of independently provisioned and environmental characteristics, such as assigned user, action, and environmental attributes.

Attribute-based access control (ABAC) is a dynamic and multidimensional approach to data security. When setting up an attribute-based access control implementation, it is best to ensure you have a tool that enables simple, scalable policy creation in order to avoid unnecessary manual work or role-explosion. The ABAC model should also be flexible, with the ability to adapt to the ever-changing world of compliance and governance. Automation, universal cloud compatibility, and customized permissions can work in tandem to provide users with safe and effective access to their data. Immuta’s attribute-based access control model provides these features and more.

The key features of ABAC solutions are that they are flexible, simple, and secure. They must be flexible in order to apply across cloud and on-premises data ecosystems while basing access decisions on a combination of attributes, roles, and purposes. They must be simple in their comprehensible policy creation and implementation, so that any stakeholder can understand the terms of data access and use. And ABAC solutions must be secure in their effective governance of data access and use, so that only users with the proper permissions are seeing the right data at the right time.

Here is an attribute-based access control (ABAC) example: Consider an organization whose product requires a monthly subscription fee. Its stored data necessarily includes customer credit card numbers to facilitate payment. To ensure only the right users are seeing this sensitive information for the right purposes, the organization could implement an ABAC policy that states “Allow users to subscribe when user possesses attribute Department with value Finance On data sources with columns tagged Discovered>Entity>Credit Card Number.” This will ensure that only users with the “Finance” attribute are able to access this information and process customer payments, without locking the policy to static or unmanageable roles.