L34
RBAC, least privilege and privileged accounts
Cram this first — memory hook
Role-Based Access Control = role gets rights; least privilege = enough, no extras; separation of duties = independent checks.
Exam trap
Role-based access for people is not the same mechanism as rule-based packet filtering on a firewall.
The slide facts
Permissions follow roles, least privilege limits access, and account management handles creation through removal. Privileged access management and separation of duties reduce concentration of power.
If you have time — extra
Role-Based Access Control () assigns permissions to job roles and users to roles. A student can submit work, a lecturer can mark it, and a network administrator can configure switches. This is easier to manage consistently than granting every individual an unrelated set of permissions. Least privilege grants only what is needed, when needed. Privileged Access Management () protects powerful accounts through controls such as approvals, separate admin identities, logging and limited-duration access. Separation of duties prevents one person from requesting, approving and executing a sensitive action without independent oversight. Roles must change when a person changes jobs; old access should not accumulate forever. One supplied infographic contains an unrelated generation-style footnote: it is source noise and is excluded from teaching.
Walkthrough
Define roles and permissions, assign the user appropriately, verify the resulting access, review it when duties change, remove access at departure, and audit privileged activity.