Role-based access control (RBAC) vs. Attribute-based access control (ABAC)

Exploring the realms of access control, authentication, and authorization as you attempt to choose the best access control model for your organization? In this video, IBM Distinguished Engineer and Adjunct Professor Jeff Crume explains the pros and cons of Roles-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC), and how they shape access decisions in real-world scenarios.

[zemalex]

7 minutes with best explanation I ever seen

[Joe]

Another video from Jeff! Yay! Every single one of his videos is an absolute gem. I wish I could attend his University classes 😭 it must be incredible to learn from him in person.

[device]

I designed my own RBAC, I created modules and assigned permissions, I assigned module permissions to roles, role permissions were assigned to users, also permissions on form fields to users, I can leave default permissions for roles and also assign them by default to users, it is quite versatile my design.

[sameervaghela]

This is really great and and very easy to understand!

[Tony-dprl]

I would say that what he called a "hybrid" scenario of RBAC is actually the most common approach. There is little value in a Role itself in anything but the most simple application. There are almost always attributes/permissions that make up a Role, often with Read/Write permissions for each individual feature/function/etc.

[houcebr]

Thanks for the video Jeff.
It would be also great to add ReBac as well and explain when to use it.

[Wthcdoctor]

RBAC is easy to understand from a "people" perspective. ABAC makes sense when there is a need for more fine-grained access to sensitive data and programs. I'd like to see a more detailed reference document (or a subsequent video) that deals with ABAC case study examples involving situations where :
(1) Privacy-related legislations impose geo-location constraints on who can create, read, update or delete personally identifiable data values
(2) Restricted access to sensitive documents (or parts of these sensitive documents) may be required depending on the attributes of end users
(3) Transactional API requests and responses may require a decision on the need for multi-factor authentication

[amigazo]

I was just reading about this yesterday and this video arrives just perfect. Thanks Jeff for sharing your valuable knowledge with us 😊
By the way, Iam currently watching your cybersecurity architecture series videos. Pure gold!

[mbeware]

TL;DR : what would be the best practices or pitfall to avoid using ABAC or hybrid system?

Way to long comment :
I would really like a more indept dive into this. ABAC can create strange things. The example in the video was simple, but sometime, there could be many combinaison possible go give or block acces to a ressouces. We might want some attributes combinaison to take priority over others. In an hybrid-system, it get more complicated. We have setup a thing at work, but I find it complicated and hard to visualized who can access what. So what would be the best practices or pitfall to avoid using ABAC or hybrid system?

[prajesh]

Impressive... what do IBM tech use to make these videos showing writing on screen and trainer face in video..

[bobbyboygaming]

The Official CISSP guide does a bad job of explaining this