Which CIA triad component is a driver for enabling role-based access controls?

Role-Based Access Control (RBAC) is fundamentally a mechanism to enforce policies that restrict access to information and system resources. The primary driver for this is Confidentiality, which is the principle of preventing the unauthorized disclosure of information. RBAC achieves this by assigning permissions to roles based on job functions rather than to individual users. This ensures that users can only access the specific information necessary to perform their duties, thereby upholding the principle of least privilege and protecting data from unauthorized viewing.

A. Integrity: While RBAC supports integrity by controlling who can modify data, its primary function is to control access itself, which is the core of confidentiality.

B. Availability: RBAC is an access control mechanism and is not primarily designed to ensure systems are operational or accessible to authorized users when needed.

D. Consistency: Consistency is not a component of the CIA triad. It is more closely related to the concept of data integrity.

1. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5. Security and Privacy Controls for Information Systems and Organizations.

Reference: Appendix F

Section F.2

Page F-5.

Details: This document defines Confidentiality as "Preserving authorized restrictions on information access and disclosure..." The entire Access Control (AC) family of security controls

of which RBAC is a model

is designed to directly support this objective by enforcing access rules.

2. Ferraiolo

D. F.

& Kuhn

D. R. (1992). Role-Based Access Control. 15th National Computer Security Conference.

Reference: Section 1

"Introduction

" Paragraph 1.

Details: This foundational NIST paper on RBAC introduces it as a method to "control access to information" based on "the roles individual users take on as part of an organization." This directly aligns with the goal of confidentiality

which is centered on controlling access.

3. Sandhu

R. S.

Coyne

E. J.

Feinstein

H. L.

& Youman

C. E. (1996). Role-Based Access Control Models. IEEE Computer

29(2)

38-47.

Reference: Section I

"Introduction

" Paragraph 2.

DOI: https://doi.org/10.1109/2.485845

Details: This seminal academic paper describes RBAC as a "means of restricting access to authorized users." This restriction is the essential mechanism for enforcing confidentiality within an organization's security policy.