Data Access Control

How can you differentiate between RBAC vs. ABAC vs. PBAC?

Role-based access control (RBAC) grants data access to users based on their role or function within the organization. This type of access control works for small organizations with few data sets and data users, but as roles, users, and rules change, data teams are forced to create new roles to accommodate organizational evolutions. As a result, a system may contain hundreds or thousands of roles that are difficult to manage and scale as organizations grow, which can lead to increased risk of data leaks and breaches.

Attribute-based access control (ABAC) is an approach to data security that permits or restricts data access based on assigned user, object, action, and environmental attributes. In contrast to RBAC, ABAC has multiple dimensions on which to apply access controls. This makes attribute-based access control a highly dynamic model because policies, users, and objects can be provisioned independently, and policies make access control decisions when the data is requested.

Policy-based access control (PBAC) applies regulation-based restrictions to sensitive personal data, as detected by automated sensitive data discovery tagging. When combined with data masking tools, this reinforces confidence that the right people are accessing the right data at the right time, and for appropriate purposes. For regulatory compliance and data audit trails, this level of control is particularly powerful and critical for ensuring data is adequately protected and reportable to legal and compliance teams.

The four main types of access control are discretionary, mandatory, role-based, and attribute-based. With discretionary access control (DAC), users create rules to determine who has access to the data through access control lists (ACLs) and capabilities tables. Mandatory access control (MAC), often regarded as the strictest type, takes a hierarchical approach to data access in which a systems admin regulates data access based on varying security clearance levels, and is widely used in the government and military. Role-based access control (RBAC) depends on a systems admin to grant access permissions based on a user’s role within the organization. Unlike RBAC, attribute-based access control (ABAC), enables data access based on attributes of the user, object, action, and environment, creating a dynamic system that vastly reduces the number of policies needed to enforce access control and avoids the need to create new roles for all changes to a data environment.

Mandatory Access Control (MAC) is considered the strictest access control model. Primarily used by the government and military, this form of access control takes a hierarchical approach to regulating data access. Security labels, denoting both classification and category, are placed on the available resources by system admins and cannot be changed by any other users. The same labels are attributed to the system’s users, so only those with the proper security credentials are able to access certain resources within the system.