What is Role-based access control?
In short
Role-based access control grants system permissions to roles, such as accounts payable clerk, rather than to individuals, and users get access by being assigned to a role.
Key takeaways
- It makes least privilege and segregation of duties easier to enforce and review.
- Roles should be designed so conflicting duties aren't combined in one role.
- Changing someone's job means changing their role, not editing many individual permissions.
Where it's tested
ISC: Information Technology General Controls (ITGCs) — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
A developer at a company has standing write access to the production database. Which ITGC category does this deficiency primarily relate to, and why does it matter?