Role-Based Access Control (RBAC) is a method of restricting system access to authorized users based on their roles within an organization. Permissions are assigned to specific roles, and users are granted access by being assigned to the appropriate role. These roles are created to align with the job functions and responsibilities of personnel, such as "network administrator," "auditor," or "help desk agent." This model simplifies administration by managing permissions for roles rather than for individual users.

A. discretionary access control: Incorrect. Access is determined by the data owner's discretion, who can grant permissions to any user, irrespective of their job function.

B. nondiscretionary access control: Incorrect. This is a broad category of access control where a central authority manages access. While RBAC is a type of nondiscretionary control, it is not the specific answer.

D. rule-based access control: Incorrect. Access is granted or denied based on a set of environmental or operational rules (e.g., time of day, location), not directly on the user's organizational job function.

1. Official Vendor Documentation: Cisco Identity Services Engine Administrator Guide

Release 3.1

"Cisco ISE Administrators and RBAC Policies" section. It states

"Role-based access control (RBAC) restricts network access based on a person's role within an organization. These permissions are then assigned to specific roles." This directly links RBAC to organizational roles (job functions).

2. Peer-Reviewed Academic Publication: Ferraiolo

D. F.

& Kuhn

D. R. (1992). Role-based access control. In Proceedings of the 15th National Computer Security Conference (pp. 554-563). This foundational paper defines RBAC

stating on page 554

"In this model

access decisions are based on the roles individual users have as part of an organization."

3. University Courseware: MIT OpenCourseWare

6.858 Computer Systems Security

Fall 2014. Lecture 4 Notes

"Access Control

" Section 3. The notes describe RBAC with the core idea: "Permissions are associated with a role. Users are assigned to roles. Roles often correspond to job functions."