Role-based access control (RBAC) in Cybersecurity - Time & Space Complexity

Time Complexity: Role-based access control (RBAC)

O(r * p)

Understanding Time Complexity

When managing who can do what in a system, it is important to understand how the time to check permissions grows as the system gets bigger.

We want to know how long it takes to verify access rights when many users and roles exist.

Scenario Under Consideration

Analyze the time complexity of the following code snippet.

// Check if a user has permission to perform an action
function hasAccess(user, action) {
  for (const role of user.roles) {
    if (role.permissions.includes(action)) {
      return true;
    }
  }
  return false;
}
    

This code checks each role assigned to a user to see if any role grants the requested permission.

Identify Repeating Operations

Identify the loops, recursion, array traversals that repeat.

• Primary operation: Looping through the user's roles and checking permissions in each role.
• How many times: The loop runs once for each role the user has; inside it, checking permissions may scan multiple permissions.

How Execution Grows With Input

As the number of roles and permissions grows, the time to check access grows roughly by multiplying these counts.

Input Size (n)	Approx. Operations
10 roles, 5 permissions each	About 50 checks
100 roles, 10 permissions each	About 1,000 checks
1000 roles, 20 permissions each	About 20,000 checks

Pattern observation: The time grows roughly with the number of roles times the number of permissions checked.

Final Time Complexity

Time Complexity: O(r * p)

This means the time to check access grows with the number of roles (r) a user has and the number of permissions (p) each role contains.

Common Mistake

[X] Wrong: "Checking access is always fast and does not depend on how many roles or permissions exist."

[OK] Correct: The code must look through each role and its permissions, so more roles or permissions mean more work and longer checking time.

Interview Connect

Understanding how access checks scale helps you design systems that stay quick and secure as they grow, a skill valued in real-world cybersecurity roles.

Self-Check

"What if permissions were stored in a fast lookup structure like a set instead of a list? How would the time complexity change?"

Practice

1. What is the main purpose of Role-based Access Control (RBAC) in cybersecurity?

easy

A. To monitor network traffic for threats

B. To encrypt data during transmission

C. To assign permissions to users based on their roles

D. To create user passwords automatically

Solution

1. Step 1: Understand RBAC concept

   RBAC assigns permissions to users based on their roles, not individually.

2. Step 2: Compare with other options

   Encryption, monitoring, and password creation are different security tasks unrelated to RBAC.

3. Final Answer:

   To assign permissions to users based on their roles -> Option C

4. Quick Check:

   RBAC = Assign permissions by role [OK]

Hint: RBAC links roles to permissions, not passwords or encryption [OK]

Common Mistakes:

• Confusing RBAC with encryption methods
• Thinking RBAC manages passwords
• Assuming RBAC monitors network traffic

2. Which of the following is the correct way to describe a role in RBAC?

easy

A. A user who accesses the system

B. A network security protocol

C. A password policy for users

D. A set of permissions assigned to users

Solution

1. Step 1: Define role in RBAC

   A role is a collection of permissions grouped for users with similar job functions.

2. Step 2: Eliminate unrelated options

   Users, password policies, and network protocols are not roles themselves.

3. Final Answer:

   A set of permissions assigned to users -> Option D

4. Quick Check:

   Role = Set of permissions [OK]

Hint: Roles group permissions, not users or passwords [OK]

Common Mistakes:

• Confusing roles with individual users
• Mixing roles with password policies
• Thinking roles are network protocols

3. Consider this scenario: A company has roles defined as 'Admin' with permissions to read, write, and delete files, and 'User' with permission to only read files. If Alice is assigned the 'User' role, what can she do?

medium

A. Only read files

B. No permissions at all

C. Write and delete files only

D. Read, write, and delete files

Solution

1. Step 1: Identify Alice's role permissions

   Alice has the 'User' role, which allows only reading files.

2. Step 2: Match permissions to actions

   Since 'User' role lacks write and delete permissions, Alice cannot perform those actions.

3. Final Answer:

   Only read files -> Option A

4. Quick Check:

   User role = Read only [OK]

Hint: Check role permissions carefully before deciding actions [OK]

Common Mistakes:

• Assuming users have admin permissions
• Confusing role capabilities
• Ignoring role assignment

4. A system administrator accidentally assigned a user both 'Guest' and 'Admin' roles, but the user should only have 'Guest' permissions. What is the best way to fix this RBAC issue?

medium

A. Add more permissions to the 'Guest' role

B. Remove the 'Admin' role from the user

C. Create a new role combining 'Guest' and 'Admin'

D. Delete the user account

Solution

1. Step 1: Identify the incorrect role assignment

   The user should only have 'Guest' permissions, but has both 'Guest' and 'Admin'.

2. Step 2: Correct the role assignment

   Removing the 'Admin' role from the user ensures they only have 'Guest' permissions.

3. Final Answer:

   Remove the 'Admin' role from the user -> Option B

4. Quick Check:

   Fix RBAC by removing wrong roles [OK]

Hint: Fix RBAC by removing incorrect roles, not adding or deleting users [OK]

Common Mistakes:

• Adding permissions to wrong roles
• Creating unnecessary combined roles
• Deleting user instead of fixing roles

5. A company wants to ensure that employees only access files necessary for their job. They have roles: 'HR' with access to employee records, 'Finance' with access to financial reports, and 'IT' with access to system logs. How should RBAC be applied to meet this requirement?

hard

A. Assign each employee to one or more roles matching their job duties

B. Give all employees access to all roles to avoid delays

C. Create a single role with all permissions for simplicity

D. Assign roles randomly to employees

Solution

1. Step 1: Understand the goal of RBAC

   RBAC limits access by assigning roles with specific permissions matching job needs.

2. Step 2: Apply roles based on job duties

   Assigning employees to roles that fit their job ensures they access only necessary files.

3. Final Answer:

   Assign each employee to one or more roles matching their job duties -> Option A

4. Quick Check:

   RBAC = Roles match job duties [OK]

Hint: Match roles to job duties for proper access control [OK]

Common Mistakes:

• Giving all employees full access
• Using one role for all permissions
• Assigning roles without considering job function