Skip to main content

Understanding PBAC: Policy-Based Access Control Quiz

Instructions​

Answer the following questions in 2-3 sentences each.

1. What is a person-relative field type and how is it used in access assignments?​

A person-relative field type is an attribute tied to a resource, where access decisions are based on the assignee's attributes rather than the resource itself. For example, a user can only view videos with ratings they are authorized for, based on their profile data like age or access level.

2. Describe the purpose of an approval right in PBAC.​

An approval right defines who can approve access requests or assignments within the PBAC system. By assigning this right to users or roles, PBAC creates virtual approval groups, simplifying the approval process without needing external group management.

3. How can you implement split approvals based on field type values?​

You can implement split approvals by enabling the "split by value for approval" setting on a right. This splits access requests into separate items for each field type value, allowing different approvers to independently approve or reject each request component.

4. Explain the difference between a local right and a local role in the PBAC data model.​

A local right is a specific permission within an application, while a local role is a collection of such permissions. The local role acts like a traditional RBAC role, grouping multiple permissions into a single assignment for easier management.

5. What is the concept of "projection" in PBAC and how does it work with Azure app roles?​

Projection in PBAC allows the assignment of non-native objects (like Empower roles) to external system rights or roles, such as Azure app roles. The PBAC engine manages these assignments by adding users to designated groups in Azure, extending PBAC policies to cloud environments.

6. How does the PBAC engine address the limitations of traditional ABAC and RBAC systems?​

The PBAC engine provides a hybrid model that combines the granularity of ABAC with the simplicity of RBAC, making permission management relational and auditable. This approach ensures a structured and clear understanding of access permissions across systems, resolving limitations like static roles in RBAC and complex policies in ABAC.

7. Why is a unified data model important for managing permissions across diverse systems like Azure, SAP, and Google GCP?​

A unified data model standardizes permissions across various systems, enabling consistent management and analysis. It allows the identification of similar access rights across platforms, simplifying risk assessment and compliance reporting in complex environments.

8. What is a fulfillment group and how is it used to connect PBAC policies with non-PBAC systems?​

A fulfillment group is an external system group, like those in Active Directory or Azure AD, used to grant access as defined by PBAC policies. When a user is assigned a PBAC right linked to a fulfillment group, they are automatically added to the external group, ensuring seamless policy enforcement.

9. How are SAP roles different from traditional RBAC roles, and how are they managed in PBAC?​

SAP roles function like groups that can contain users and permissions, such as T-codes, and can be nested. Unlike traditional RBAC roles, they do not define specific permission sets. PBAC manages these roles by inventorying memberships and permission assignments for better reporting and analysis.

10. What are the benefits of recertifying access based on local rights and roles rather than groups?​

Recertifying access based on local rights and roles provides more precision and control, as it focuses on specific permissions rather than general group memberships. This approach enhances security by ensuring users have only the necessary access, improving compliance and reducing risk.

Quiz Answer Key​

  1. Person-relative field type: An attribute associated with a resource but used for access decisions based on the assignee's values.
  2. Approval right: Determines who can approve access requests within PBAC, forming virtual approval groups.
  3. Split approvals: Configured by splitting requests into items per field value, allowing independent approver decisions.
  4. Local right vs. local role: A local right is a single permission; a local role is a bundle of permissions.
  5. Projection: Extends PBAC policies to external systems by assigning non-native objects and managing memberships in groups like Azure.
  6. PBAC engine: Combines ABAC's flexibility with RBAC's structure for auditable, relational permission management.
  7. Unified data model: Standardizes permissions for consistent analysis and simplified risk assessment across platforms.
  8. Fulfillment group: An external system group used to grant access according to PBAC policies.
  9. SAP roles: Act like groups with nested permissions; managed in PBAC for comprehensive access reporting.
  10. Recertifying local rights and roles: Provides precise control, focusing on actual permissions rather than general group access.

Essay Questions​

  1. Virtual Approval Groups in PBAC: Explain the concept and advantages of using virtual approval groups instead of traditional approval mechanisms.
  2. Managing Permissions in Cloud Environments: Discuss the challenges and how PBAC provides a structured solution.
  3. PBAC Field Types vs. ABAC: Compare how both systems use attributes for access control, highlighting differences in implementation.
  4. Unified Data Model Implications: Analyze how a unified model enhances risk management and compliance reporting across systems.
  5. Ethical Considerations in PBAC: Reflect on the responsibilities of managing sensitive information using a PBAC system.

Glossary of Key Terms​

  • PBAC: Policy-Based Access Control, a hybrid approach integrating RBAC and ABAC principles.
  • Person-Relative Field Type: Resource attribute evaluated based on the assignee's values for access decisions.
  • Approval Right: A right that specifies who can approve access requests or assignments.
  • Split by Value for Approval: Divides requests into items based on selected field values, allowing separate approvals.
  • Local Right: A specific permission, either within an application or an external system.
  • Local Role: A collection of local rights, similar to an RBAC role.
  • Projection: Extending PBAC policies to non-PBAC systems via group assignments.
  • Fulfillment Group: An external group used to enforce PBAC-based access.
  • SAP Role: A nested group-like entity in SAP that contains permissions and users.
  • Recertification: The process of reviewing and validating user access to maintain security and compliance.
  • Unified Data Model: A common structure for managing permissions across various platforms.