There seems to be very good enthusiasm for identity management products amongst the end user community as a cost effective solution to manage compliance. The vendors are also vying with each other in advancing the prospects for their products. Many times, the user community is barely informed to appreciate the solutions offered but are not fully equipped to evaluate the different offerings.
After the marketing hype of increasing compliance, improving efficiency, increasing security, reducing risk, reducing cost are over, it would be a good thing to ask the vendors whether their product is RBAC compliant? Obviously the marketing would be stunned at the question. Even when they bring in the more technical types, it might be difficult to answer whether their product is fully RBAC compliant.
If they say that ROLES are same as ?GROUPS?, then they need to be dismissed asking them to study the RBAC more thoroughly and return to answer the question later. If they say that RBAC is implemented, then they could be asked to answer the follow up questions:
1. Can I define roles and assign users to these roles?
2. Can I grant and revoke permissions to these roles?
3. Can I view all the users assigned to a particular role?
4. Can I view all the roles assigned to a particular user?
5. Can I activate multiple roles in a session?
6. Does the system provide all the permissions assigned to all the roles ?
7. Is there a way I can put constraint on the roles that can be assigned to a user on the basis of Static Separation of Duties?
8. Can I define Dynamic Separation of Duties and expect the system to impose these constraints on a user while seeking to exercise the permissions these constraints are supposed to constrain.
9. Are the permissions inherited bottom up?
10. Are the user memberships inherited top down?
RBAC is a standard which is reasonably stabilized since early 2000?s. Unfortunately, the vendors seem to have either not understood the full implication of the standard or they seem to be vague when it comes to their compliance to RBAC. Vendor literature are so thoroughly confusing and the part of blame should go to lack of understanding of RBAC amongst the so called ?experts? who wrote the manuals and the colored books.
Some vendors have not at all complied with the standard. Others tend to use the term Roles but then redefine Groups as Roles. Groups existed even with the early Unixes and if they are same as Roles, why did the researchers define a new paradigm for access control? Just changing the terminology was sufficient, why create a new paradigm?
There is need for thorough review of the capability of the products to take advantage of RBAC. The earlier the vendors realize this, better it is for the industry.