Role-based access control (RBAC) in Cybersecurity - Mini Project: Build & Apply

Role-based Access Control (RBAC) Basics

📖 Scenario: You are setting up a simple access control system for a small company. Different employees have different roles, and each role has specific permissions to access parts of the company's computer system.

🎯 Goal: Build a clear structure that shows which roles exist, what permissions each role has, and assign users to roles. This will help understand how RBAC works in real life.

📋 What You'll Learn

Create a dictionary called roles with three roles: Admin, Editor, and Viewer.

Each role should have a list of permissions exactly as: Admin has ['read', 'write', 'delete'], Editor has ['read', 'write'], and Viewer has ['read'].

Create a dictionary called users with three users: 'Alice', 'Bob', and 'Charlie'.

Alice should have the role 'Admin', Bob the role 'Editor', and Charlie the role 'Viewer'.

Create a function called get_user_permissions that takes a username and returns the list of permissions for that user's role.

💡 Why This Matters

🌍 Real World

RBAC is used in companies to control who can see or change information, keeping systems safe and organized.

💼 Career

Understanding RBAC is important for cybersecurity roles, system administration, and software development to manage user access securely.

1

Create the roles dictionary

Create a dictionary called roles with these exact entries: 'Admin': ['read', 'write', 'delete'], 'Editor': ['read', 'write'], and 'Viewer': ['read'].

Cybersecurity

# Create the roles dictionary with exact roles and permissions
# Your code here

Hint

Use a dictionary with role names as keys and lists of permissions as values.

2

Create the users dictionary

Create a dictionary called users with these exact entries: 'Alice': 'Admin', 'Bob': 'Editor', and 'Charlie': 'Viewer'.

Cybersecurity

roles = {
    'Admin': ['read', 'write', 'delete'],
    'Editor': ['read', 'write'],
    'Viewer': ['read']
}
# Create the users dictionary with exact usernames and roles
# Your code here

Hint

Use a dictionary with usernames as keys and their roles as values.

3

Define the permission lookup function

Define a function called get_user_permissions that takes a parameter username and returns the list of permissions for that user's role by looking up users and roles dictionaries.

Cybersecurity

roles = {
    'Admin': ['read', 'write', 'delete'],
    'Editor': ['read', 'write'],
    'Viewer': ['read']
}

users = {
    'Alice': 'Admin',
    'Bob': 'Editor',
    'Charlie': 'Viewer'
}

# Define get_user_permissions(username) function
# Your code here

Hint

Use users.get(username) to find the role, then roles.get(role, []) to get permissions.

4

Complete the RBAC setup

Add a comment at the end of the code explaining that this setup allows checking user permissions based on their role.

Cybersecurity

roles = {
    'Admin': ['read', 'write', 'delete'],
    'Editor': ['read', 'write'],
    'Viewer': ['read']
}

users = {
    'Alice': 'Admin',
    'Bob': 'Editor',
    'Charlie': 'Viewer'
}

def get_user_permissions(username):
    role = users.get(username)
    if role:
        return roles.get(role, [])
    return []

# Add a comment explaining the purpose of this RBAC setup
# Your code here

Hint

Add a clear comment describing the purpose of the code.

Practice

1. What is the main purpose of Role-based Access Control (RBAC) in cybersecurity?

easy

A. To monitor network traffic for threats

B. To encrypt data during transmission

C. To assign permissions to users based on their roles

D. To create user passwords automatically

Solution

1. Step 1: Understand RBAC concept

   RBAC assigns permissions to users based on their roles, not individually.

2. Step 2: Compare with other options

   Encryption, monitoring, and password creation are different security tasks unrelated to RBAC.

3. Final Answer:

   To assign permissions to users based on their roles -> Option C

4. Quick Check:

   RBAC = Assign permissions by role [OK]

Hint: RBAC links roles to permissions, not passwords or encryption [OK]

Common Mistakes:

• Confusing RBAC with encryption methods
• Thinking RBAC manages passwords
• Assuming RBAC monitors network traffic

2. Which of the following is the correct way to describe a role in RBAC?

easy

A. A user who accesses the system

B. A network security protocol

C. A password policy for users

D. A set of permissions assigned to users

Solution

1. Step 1: Define role in RBAC

   A role is a collection of permissions grouped for users with similar job functions.

2. Step 2: Eliminate unrelated options

   Users, password policies, and network protocols are not roles themselves.

3. Final Answer:

   A set of permissions assigned to users -> Option D

4. Quick Check:

   Role = Set of permissions [OK]

Hint: Roles group permissions, not users or passwords [OK]

Common Mistakes:

• Confusing roles with individual users
• Mixing roles with password policies
• Thinking roles are network protocols

3. Consider this scenario: A company has roles defined as 'Admin' with permissions to read, write, and delete files, and 'User' with permission to only read files. If Alice is assigned the 'User' role, what can she do?

medium

A. Only read files

B. No permissions at all

C. Write and delete files only

D. Read, write, and delete files

Solution

1. Step 1: Identify Alice's role permissions

   Alice has the 'User' role, which allows only reading files.

2. Step 2: Match permissions to actions

   Since 'User' role lacks write and delete permissions, Alice cannot perform those actions.

3. Final Answer:

   Only read files -> Option A

4. Quick Check:

   User role = Read only [OK]

Hint: Check role permissions carefully before deciding actions [OK]

Common Mistakes:

• Assuming users have admin permissions
• Confusing role capabilities
• Ignoring role assignment

4. A system administrator accidentally assigned a user both 'Guest' and 'Admin' roles, but the user should only have 'Guest' permissions. What is the best way to fix this RBAC issue?

medium

A. Add more permissions to the 'Guest' role

B. Remove the 'Admin' role from the user

C. Create a new role combining 'Guest' and 'Admin'

D. Delete the user account

Solution

1. Step 1: Identify the incorrect role assignment

   The user should only have 'Guest' permissions, but has both 'Guest' and 'Admin'.

2. Step 2: Correct the role assignment

   Removing the 'Admin' role from the user ensures they only have 'Guest' permissions.

3. Final Answer:

   Remove the 'Admin' role from the user -> Option B

4. Quick Check:

   Fix RBAC by removing wrong roles [OK]

Hint: Fix RBAC by removing incorrect roles, not adding or deleting users [OK]

Common Mistakes:

• Adding permissions to wrong roles
• Creating unnecessary combined roles
• Deleting user instead of fixing roles

5. A company wants to ensure that employees only access files necessary for their job. They have roles: 'HR' with access to employee records, 'Finance' with access to financial reports, and 'IT' with access to system logs. How should RBAC be applied to meet this requirement?

hard

A. Assign each employee to one or more roles matching their job duties

B. Give all employees access to all roles to avoid delays

C. Create a single role with all permissions for simplicity

D. Assign roles randomly to employees

Solution

1. Step 1: Understand the goal of RBAC

   RBAC limits access by assigning roles with specific permissions matching job needs.

2. Step 2: Apply roles based on job duties

   Assigning employees to roles that fit their job ensures they access only necessary files.

3. Final Answer:

   Assign each employee to one or more roles matching their job duties -> Option A

4. Quick Check:

   RBAC = Roles match job duties [OK]

Hint: Match roles to job duties for proper access control [OK]

Common Mistakes:

• Giving all employees full access
• Using one role for all permissions
• Assigning roles without considering job function