Set yourself up for success by following these role-based access control best practices. Don’t expect IT to implement RBAC alone. Begin with a conversation across departments, and then proceed systematically to ease the transition and avoid unnecessary friction in your workforce as new systems roll out. RBAC implementation requires high-level understanding of business structure and goals. By collaborating from the start, you will be better prepared to reap the benefits of RBAC and get the most out of your efforts.
Develop an RBAC Strategy
Start by evaluating where you are. What systems, data, or processes in your organization would benefit from access control? Be sure to include any job functions, technologies, and business operations. Paint with broad strokes in the beginning. You will refine the process as you go along.
Next, consider where you want to be. Will you use RBAC to automate provisioning? Do you need a better way to control access to applications that store sensitive data? What is your desired outcome for this process?
Finally, note any gaps you need to tackle. Are your authentication/authorization models consistent across your organization? Are there compliance or regulatory requirements you need to meet? Was there a security event that prompted you to switch to RBAC?
Once you have mapped out your strategy, you are ready to move on to the details.
Inventory Your Systems
Make a list of every resource or service that requires access control. The list may include email, cloud apps, customer databases, shared folders on a file server, and so on.
Analyze Your Workforce
Role and access discovery is both art and science, and collaboration across IT, HR, and executive leaders will make the process easier.
Start by grouping your workforce into roles based on shared access needs. Be sure to include both current and planned departments. At the same time, avoid the trap of defining too many roles. How many is too many? That will depend on your organization. The right number will restrict access enough to secure your systems without stifling creativity.
Larger organizations may require a more systematic method of role creation in order to avoid common pitfalls such as role explosion, role overlap, and over-reliance on exceptions. Here, we recommend a two-pronged approach.
- Evaluate roles from the top down. Business managers should design a set of roles that align with company goals and take the entire workforce into consideration. Rather than focusing on systems and technology, the top-down approach should address the functional access needs of each role.
- Concurrent with phase one, IT can begin a bottoms-up analysis, gathering information about the way users are accessing systems. Then generate roles based on this analysis.
Create and Define Roles
Finally, reconcile your lists. Map the result of your workforce analysis to the resources from your inventory according to the principle of least privilege. This mapping will define your roles.
For example, you may create a Basic User role, which has access to email and Slack and applies to all users in the organization. You may create a specialist role, such as Hiring Manager, which has read/write access to the employee database. You may create an Employee Database Administrator role, which has full control of the employee database. And so on for each department.
Establish a Governance Structure
In addition to defining roles, you need to establish a decision-making body to maintain them. Articulate, in writing, the project priorities and standards that serve the best interests of your organization as a whole.
Your access control policies may include:
- performance measures
- risk-management strategies
- role re-evaluation guidelines
- direction regarding who maintains roles
- a plan to keep the policy up to date
Policy-based access control helps prevent role proliferation and keeps your RBAC project on track even as your company grows or conflicts between departments arise.
Assign People to Roles
All of that preparation has laid the groundwork for the final step: implementation. Now that you have inventoried your systems and outlined the way your workforce uses them, it is time to assign roles to your employees and begin using RBAC to manage access rights and permissions.
Larger organizations may choose to roll out RBAC in stages. Start with a small group of users, organized around a business function or department. Collect feedback and make any adjustments before moving to the next stage. This will minimize workforce disruption, help you build on small successes, and demonstrate the value of the role-based access control model.
Congratulations! You have now successfully implemented RBAC in your organization. Your next task is to keep it running smoothly.
