THE IMPORTANCE OF USER ACCESS CONTROL And Why I Recommend RBAC (ROLE BASED ACCESS CONTROL)

USER ACCESS CONTROL IS CRITICAL SARBANES OXLEY (SOX) law passed in 2002 to protect investors from fraud, applies to ALL publicly held companies; some sections apply to privately held companies. Failure of privately owned companies to follow Sarbanes Oxley guidelines can derail future plans for taking company public and/or selling business to a privately owned company. A Key Principle of SARBANES OXLEY is User Access Control

WHAT IS USER ACCESS CONTROL? A way to ensure segregation of duties It takes more than one person to complete a task Internal controls to help prevent error Makes it harder for individuals to commit fraud

Access Control As It Relates To User Identity Minimum Access – users should have access to ONLY the data that they need to perform their job Users need full access to data that they need to be able to manipulate (create, modify, save) Provide Read-only access to data created by other people users need in order to do their job.

Individual Access vs Role Based Access Possible to setup individual access for each user especially in smaller companies More desirable to create user roles based on job description As you add new employees, simply assign them appropriate role rather than create individualized access When employees change departments simply change role to which they are assigned

Advantages & Disadvantages of RBAC Advantage: Easy Scalabilty Advantage: Less Administration Required; Saves time Disadvantage: Less flexibility; can’t override access permissions Disadvantage: Can be a nightmare if organization is not well structured

RBAC is Best User Access Control System RBAC is the best way to manage user access if your organization has a clear structure, clear job descriptions, and a management team willing to enforce the roles. Not using Role Based Access Controls can make it harder to grow the company, and to sell the company in the future. A good Role Based Access Control can save time and money. It can also help protect the company from fraud.