# Presentation: 815089

## Role-Based Security Solutions

- Albert Torres
- Director of IT and R&D
- albert@payplusbenefits.com
- www.payplussolutions.com
- IMA
- December 7th, 2004

## Outline

- Background
- Define the current problem
- Define Role-Based Security
- How does this solution work
- Conclusion

## Background

- The driving force behind Role-Based Security is the shift towards an information-based business economy and the Internet.
- Most business organizations realize that information must be stored, retrieved, analyzed, and acted on at a moment's notice.

## Background

- Today more people need:
- More access
- More security
- More information
- More often
- In order to make more decisions
- Businesses are operating under hyper-competition.

## Background

- One of the primary purposes of an information system is decision support.
- Every person involved in the organization participates in some level of decision making.

## Define the Problem

- Most information systems were designed before the current implementation or use of the Internet.
- Many information systems can have an unprecedented amount of information.

## Define the Problem

- While solving one problem of granting more information, it created a whole new set of problems.
- Some examples include:
- Privacy and Security Concerns
- New regulations such as
- 		HIPPA Compliance

## Define the Problem

- Privacy and Security Concerns
- A large amount of personal information about each of us is stored in various computers. Personal data can be used in identity theft or fraud. An imposter may create fake financial accounts and run up huge debts, or may simply appropriate someone else's finances.

## Define the Problem

- HIPAA Compliance
- The U.S. Health Insurance Portability and Accountability Act (HIPAA) is not specifically an Internet privacy law, but it does address the sharing of health-related information and therefore could affect many online businesses. Although HIPAA has become effective, the rules are controversial and compliance with these rules are burdensome and complicated.

## Define the Problem

- One of the most challenging problems in managing large networked systems is the complexity of security administration.
- Security administration is costly and prone to error because administrators usually specify access control lists for each user on the system individually.

## Define Role-Based Security

- Role-based security is a technology that is attracting increasing attention, particularly for commercial applications, because of its potential for reducing the complexity and cost of security administration in large networked applications.

## Define Role-Based Security

- With role-based security, permissions are managed at a level that corresponds closely to the organization's structure.
- Each user is assigned one or more roles, and each role is assigned one or more sets of access privileges that are permitted to users in that role.

## Define Role-Based Security

- Role-based security administration consists of determining the operations that must be executed by persons in particular jobs, and assigning employees to the proper roles.
- Role-based security makes security administration far easier and less prone to “holes” in the access rights of individuals.

## How does this solution work

- In terms of role-based security, “access” is the ability to do something (e.g. use, change, or view) a computer resource. Role-based security can prescribe not only who or what process may have access to a specific system resource, but also the type of access that is permitted.

## How does this solution work

- With role-based access control, access decisions are based on the roles that individual users have as part of an organization. Users take on assigned roles, such as doctor, nurse, teller, manager.

## How does this solution work

- One of the keys to accomplishing Role-Based Security was breaking each field in the data warehouse and not viewing information in terms of reports.

## How does this solution work

## How does this solution work

## Conclusion

- The process of defining roles should be based on a thorough analysis of how an organization operates.  It should include input from a wide spectrum of users in an organization, including HR.

## Conclusion

- The use of roles to control access can be an effective means for developing and enforcing enterprise-specific security policies and for streamlining the security management process.

## Albert Torres

- Director of IT and R&D
- albert@payplusbenefits.com
- www.payplussolutions.com
- 1110 North Center Parkway Suite B Kennewick, WA 99336 Phone: (509) 735-1143