Attribute-based access control (ABAC) is an access management model that takes inspiration from role-based access control. Defining a collection of attributes for the elements of your system is the foundation of attribute-based access control. This model is made up of many parts.
Attribute: It relates to the nature of elements within the network. User characteristics such as clearance standard, agency, role, or even IP address are often used to refer to it. Among other things, it may refer to object attributes, such as creator, sensitivity, and type. An attribute may also refer to the environment’s characteristics, such as place, time, and date.
Action Type: The action that is carried out on the network. Copying, pasting, deleting, reading, or writing, for instance.
Subject: This is any person or resource within the network that can carry out actions. To assess their clearance level, the subject is also assigned attributes.
Object: An object is any data stored on the network. To allow definition and identification, they are assigned attributes.
Policy: A collection of rules that are used to control all network operations.
You may make use of attributes that have not been documented in the ABAC model but that will still be visible in the work phase. It is a model that can be used in organizations of various sizes, but a large organization suits the most.
When it comes to deployment and configuration, ABAC takes enough time and effort. This is because all of the system’s attributes must be specified. This is manually handled. Policies, too, need to be created in order for any new user and resource to be copied. With the ABAC model, it is possible to change attributes to meet a user’s needs without actually creating a new role for them. These are the characteristics that make ABAC a more polished system than role-based access control (RBAC).
Attribute-Based Access Control vs. Role-Based Access Control
Access to data is constantly changing in order to address the numerous challenges facing organizations in this era of limitless data. The norm today is none other than ABAC. It is a model that ensures that when necessary and under the right conditions, information is retrieved.
Benefits And Limitations Of RBAC
RBAC was, in the past, the most common way to limit access to a secure space. Its key benefit is that there is no need for businesses to approve or revoke access individually. Users are brought together by this scheme according to their roles. This makes work easier, but it is not an easy job to set up.
Unable to set up rules using undefined parameters.
Permissions are allocated to user roles only.
Access may be limited to specific actions in the system, but not to certain data.
Benefits And Limitations Of ABAC
The ABAC model’s key advantage is that access is given not on the basis of the user but on the attributes of each system component. This implies that it is possible to define every rule, no matter how complex. It is possible to determine the characteristics of subjects and resources not yet entered into the scheme.
Policies have to be defined and maintained, making it hard to configure this form of system.
Prior to deciding the permissions that will be applicable to the end-user, it is difficult to conduct a factual audit.
For any given place, it may be almost impossible to quantify risk exposure.
ABAC is a multi-dimensional access control system and guarantees the following:
- Better scalability
- Prevention of role explosion
- Eliminates issues with SoD
- Eases authorization for better management control
The process of authorization is complex since it requires analyzing a whole context. Multiple sources, such as the application and the environment, can contribute to the attributes of a given scenario. In turn, the key attributes lead to the policy, and then the rules are assessed. The next step is the authorization engine’s collection of the necessary attributes. This is the only way it is possible to complete the decision process.