Rules and roles

In our Enterprise Applications section this week we had an interesting story looking at two of the major control mechanisms corporations use to manage users and resource access: roles and rules .

In our Enterprise Applications section this week we had an interesting story looking at two of the major control mechanisms corporations use to manage users and resource access: roles and rules.

Our author (jfontana@nww.com) says among other benefits, using roles and rules-based models can help tighten security around network resources and ensure compliance with federal regulations such as the Sarbanes-Oxley Act, Gramm-Leach-Bliley Act and the Health Insurance Portability and Accountability Act.

Roles are predetermined sets of access privileges that are associated with a group of users on a network. Users are assigned to roles and inherit their access privileges. The National Institute of Standards and Technology (NIST) first developed the model, called Roles Based Access Control (RBAC), more than a decade ago. The Massachusetts Institute of Technology, Stanford University, Sun and PricewaterhouseCoopers are among those that have developed their own role-based models.

In comparison, rules were introduced recently with the advent of provisioning systems, are more flexible, and act as “if/then” expressions that are executed within software at the time a user attempts to access a network resource. For example, a rule might state “if” the user has the title sales manager and works in Division A “then” he is entitled to access system B.

Interest in roles and rules is accelerating, especially with the number of networked applications growing along with the internal and external users seeking access. Corporate users are seeking options and vendors are listening, including Beta Systems, Business Layers, IBM, Microsoft, Netegrity, Novell, OpenNetwork Technologies, RSA Security, Siemens and Waveset.

There are many issues in implementing rules and roles across your enterprise. For more on this story see: https://www.nwfusion.com/news/2003/1006rulesroles.html