Honors Program
Honors in Business
Date of Award
5-2023
Thesis Professor(s)
Mohammad Khan
Thesis Professor Department
Computing
Thesis Reader(s)
Matthew Harrison
Abstract
Access control models and implementation guidelines for determining, provisioning, and de-provisioning user permissions are challenging due to the differing approaches, unique for each organization, the lack of information provided by case studies concerning the organization’s security policies, and no standard means of implementation procedures or best practices. Although there are multiple access control models, one stands out, role-based access control (RBAC). RBAC simplifies maintenance by enabling administrators to group users with similar permissions. This approach to managing user permissions supports the principle of least privilege and separation of duties, which are needed to ensure an organization maintains acceptable user access security requirements.
However, if not properly maintained, RBAC produces the problem of role explosion. What happens when security administrations cannot maintain the increasing number of roles and their assigned permissions provisioned to the organization users?
This paper attempts to solve this problem by implementing a scalable RBAC system and assigning each permission a risk value score determined by the severity of risk it would expose the organization to if someone had unauthorized access to that permission. Using RBAC’s role and permission design, each user will be assigned a risk value score determined by the summation of their roles’ risk based on permission values. This method allows security administrators to view the users and roles with the highest level of risk, therefore prioritizing the highest risk users and roles when maintaining user roles and permissions.
Publisher
East Tennessee State University
Document Type
Honors Thesis - Open Access
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.
Recommended Citation
Damrau, Adelaide, "RBAC Attack Exposure Auditor. Tracking User Risk Exposure per Role-Based Access Control Permissions" (2023). Undergraduate Honors Theses. Paper 784. https://dc.etsu.edu/honors/784
Copyright
Copyright by the authors.
Included in
Databases and Information Systems Commons, Information Security Commons, Other Computer Sciences Commons