Which secure coding practice uses role-based authentication where department-specific credentials will authorize department-specific functionality?

The scenario describes Role-Based Access Control (RBAC), a specific model of the broader secure coding practice known as Access Control. This practice involves enforcing policies that govern what an authenticated user is permitted to do. In this case, a user's role (determined by their department) dictates which specific functionalities they are authorized to access. While authentication verifies the user's identity, it is the access control mechanism that uses this identity and associated role to make authorization decisions, thereby restricting access to sensitive or role-specific functions.

B. Data Protection: This practice focuses on protecting data at rest or in transit, typically through encryption or tokenization, not on controlling access to application functionality.

C. Input Validation: This practice involves sanitizing and validating all data received from a client to prevent attacks like SQL injection or Cross-Site Scripting (XSS).

D. Authentication: This is the process of verifying a user's identity (proving they are who they say they are), which precedes the authorization step described in the question.

---

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (Special Publication 800-53, Revision 5). Section AC-2, "Account Management," and AC-3, "Access Enforcement." The document defines access control as the process of granting or denying specific requests to obtain and use information and related information processing services. RBAC is cited as a primary model for enforcing this.

2. Ferraiolo, D. F., & Kuhn, D. R. (1992). Role-Based Access Control. Proceedings of the 15th National Computer Security Conference, (pp. 554-563). This foundational paper defines RBAC as a method of restricting system access to authorized users, where permissions are associated with roles, and users are assigned to appropriate roles.

3. OWASP Foundation. (2023). Access Control Cheat Sheet. OWASP Cheat Sheet Series. Retrieved from https://cheatsheetseries.owasp.org/cheatsheets/AccessControlCheatSheet.html. Section "What is Access Control." This resource explicitly states, "Access control is the application of constraints on who or what is authorized to perform actions or access resources." It distinguishes this from authentication.

4. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9), 1278-1308. https://doi.org/10.1109/PROC.1975.9939. Section I.A.3, "Checking Authorization." This seminal academic paper on computer security distinguishes between authentication (identifying the user) and authorization/access control (checking permissions for a requested action).