Roles vs Attributes: Access Control
Key Points
- The video distinguishes authentication (identifying “who you are”) from authorization (determining “what you’re allowed to do”), highlighting that the latter is often overlooked.
- It introduces two primary authorization models—Role‑Based Access Control (RBAC) and Attribute‑Based Access Control (ABAC)—and compares their advantages and disadvantages.
- Using a hospital scenario, the speaker shows how managing permissions without roles quickly becomes complex and unmanageable as users and capabilities grow.
- By assigning users to roles (e.g., doctor, nurse, lab technician), RBAC simplifies permission management, making updates and onboarding far easier and more scalable.
Full Transcript
# Roles vs Attributes: Access Control **Source:** [https://www.youtube.com/watch?v=rvZ35YW4t5k](https://www.youtube.com/watch?v=rvZ35YW4t5k) **Duration:** 00:07:32 ## Summary - The video distinguishes authentication (identifying “who you are”) from authorization (determining “what you’re allowed to do”), highlighting that the latter is often overlooked. - It introduces two primary authorization models—Role‑Based Access Control (RBAC) and Attribute‑Based Access Control (ABAC)—and compares their advantages and disadvantages. - Using a hospital scenario, the speaker shows how managing permissions without roles quickly becomes complex and unmanageable as users and capabilities grow. - By assigning users to roles (e.g., doctor, nurse, lab technician), RBAC simplifies permission management, making updates and onboarding far easier and more scalable. ## Sections - [00:00:00](https://www.youtube.com/watch?v=rvZ35YW4t5k&t=0s) **Understanding RBAC vs ABAC** - The speaker explains access control concepts, contrasting role‑based and attribute‑based authorization using a hospital example. ## Full Transcript
two questions for you who are you and
what are you allowed to do these are two
questions that go into what we call
Access
Control access control is involved in
these two steps I've talked a lot about
this one in previous videos about
authentication this is where we get
things like multiactor authentication
password strength rules pass keys and
things of that sort that's answering the
question who are you but I'll tell you
the harder question to answer is this
one what are you allowed to do this is
the area of authorization and that's one
that often gets overlooked the subject
of today's video then is going to deal
with two different approaches to
authorization roles-based access control
and attribute based access control rback
and aback let's take a look at the two
and see what are the pros and cons of
each okay let's take a look at what it
looks like if we don't use rols for our
Access Control decisions so let's say we
have a hospital environment and we've
got a doctor here and a doctor should be
able to write orders that the nurses
follow and other people follow uh they
should be able to read the orders that
they've written they can read the lab
reports that have come but they can't
write the lab reports only a lab
technician can create those reports and
the lab technician should be able to
read these but probably not the others
of these kinds of things uh so then we
also have say a bunch of nurses and the
nurse nures cannot write orders but they
can read them so that they can follow
them uh all the nurses should be able to
maybe read the labs uh to understand
what's there but they don't write so you
can see what happens here as we expand
this out to more and more users and more
and more capabilities this is a trivial
example with just four capabilities and
five users imagine if we scale this to
thousands or tens of thousands or
hundreds of thousands what does this
spaghetti look like it gets to be a real
mess so that's without
roles how about if we introduce roles
into the case so in this case what I do
is I say okay doctors all doctors can
write orders they can read orders they
can read Labs nurses can read orders
they can read labs and a lab technician
can write labs and read labs this looks
fairly simple because I'm talking about
them in aggregate this is an abstraction
of what a lot of different people would
do
now all I have to do in order to
implement this is map the individual
users into the roles that they fill so I
say this person's a doctor these people
are all nurses and this person is a
labtech and voila so with rolls then I
get something that is much simpler much
cleaner and much easier to manage
imagine later if I come along and say
you know what we need to add a new
capability I don't know what we're going
to call it but so some new function and
in fact I'd like nurses and doctors to
be able to do it that's all I have to do
I don't have to go back and change all
of this or if we get a new employee that
comes in and we say oh yeah the new
employee that person's a labtech I just
map them to the role and they pick up
all the capabilities so you can see what
we've done here is we've simplified by
abstracting out and we're giving access
rights based upon the role the person
plays within the organization
so that was a look at role-based Access
Control in that case what you get to do
depends on what role you're assigned to
the other approach to this that we're
going to look at is attribute based
access control so with attributes we
could look at a lot of different things
such as what geography are you in is it
us is it Europe is it uh Latin America
this sort of thing uh position what kind
of a position do you have within the
organization uh that's another thing we
could look at uh the Department that
you're in uh your employment status are
you a permanent full-time employee a
contractor a part-timer that may affect
what we give you access to are you a
manager or not and what is your
clearance level are you allowed to see
high security High sensitivity medium or
low or secret top secret that sort of
thing so these are just examples of
attributes you could dream up your own
as well but let's take a look at what an
example would be if I used attributes
let's say we have an individual who
wants access to a particular report and
we may build an attribute based Access
Control rule that says basically you
have to have a clearance of high that is
that you can see the most sensitive
stuff you have to be a manager and you
have to be in the finance department and
if all of these things are true then
you're given access to this particularly
sensitive financial information so
that's an example of this
okay I just took you through an example
of attribute based access control and
before that we looked at role-based
Access Control aback and rback which one
is better well it all depends it depends
on what you're trying to do if you're in
an organization that is fairly
hierarchical then you may find that
roles naturally will sort of suggest
themselves to you if however you're in
an organization where that's not the
case and you may need more flexibility a
more dynamic system then ABAC may be
better so more Dynamic probably simpler
uh although you could do either of these
and make them really overly complicated
I've seen examples of both but I'm going
to suggest to you it's not necessarily
either or in fact it could be both and
you could do a hybrid approach where you
use both rback and aback in order to
accomplish the job I might use a role as
your high level to assign the attribute
that you're supposed to have so they can
work together let's take a look at an
architectural example of how you would
Implement these in the real world so
let's take a user here this user wants
access to a particular resource so we're
going to put something to mediate Access
Control access in between the two of
them a security component so they come
into this and we call this policy
enforcement point the policy enforcement
point will go up and ask another
architectural component known as the
policy decision point should I grant
access to this user to this resource
It'll ask that question and get an
answer back and if the answer is yes
then it allows access if the answer is
no well then it blocks access fairly
simple so you got a p and a PDP that are
involved in this and the decision
separate from the enforcement the
enforcement is a simple yeah you get it
or no you don't the decision is really
where all the hard work goes in
in fact you could use rback as the way
to inform these decisions or you could
use aback or again you could use both so
there are advantages to both of these
they don't have to be one or the other
and you should choose whichever one fits
best for your
organization if you like this video and
want to see more like it please like And
subscribe if you have any questions or
want to share your thoughts about this
topic please leave a comment
below e