Role Base Access Control and its administrative implementation with Windows 2000

Abstract

Administration of access control was and still is a crucial, critical and complex aspect of Security Administration. Many models were developed and used to effect this administration such as Mandatory access Control (MAC), Discretionary Access Control (DAC) and Role Base access Control. the latter, RBAC which is a flexible and policy-independent access control, represents a natural structure of an organization where functions are grouped into roles and users are permitted to one or more of these roles. In large organizations with relatively large systems, with hundreds of roles and users and thousands and more of permission(s), managing all the roles, users, and permission(s) is not an easy task that can be centralized in a small team of security administrators. While it is not a new concept, Role Based Access Control continues to gain wider commercial acceptance as it simplifies and enhances definition, auditing and administration of security access rights. Moreover,it has been implemented in different areas, such as ORACLE and solaris. In this thesis RBAC is applied to Windows 2000 in order to simplify the management of security, through using a simulation of ARBAC administration capabilities on Windows 2000 implementing groups hierarchies and the decentralization of group assignments.