A.APPLY AN ACCESS CONTROL MODEL TO THE PROVIDED USER ROLE MATRIX
AND ACCESS CONTROL POLICIES IN THE ATTACHED "SECURITY OPERATIONS
ARTIFACT" BY DOING THE FOLLOWING:
A1. SUGGESTED ACCESS CONTROL METHOD
The organization should utilize Role-Based Access Control (RBAC). RBAC is
congruent with the company's declared access control policies and the user role matrix
framework. “Role-based access control (RBAC) is a model for authorizing end-user
access to systems, applications and data based on a user’s predefined role” (Lindemulder
& Kosinski, 2026). The company currently follows this framework based on the
environment, as access is widely granted by position titles such as the IT administrator,
finance manager, and HR coordinator, and system/privilege is structured around the
roles. Structuring access with this approach allows RBAC to back consistency, scalability
and streamlined administration across the companies departments.
A core element of RBAC is the principle of least privilege. It is moderately
executed but it isn’t applied consistently throughout the company. The customer
support representative and the security analyst positions are properly limited to read-
only access, which highlights the attempt to minimize permissions to what is required to
perform the job. However, many violations subvert the least privilege principle. For
example, domain administrator privileges are assigned to a junior system administrator
and access to the payroll system can be granted to customer support representatives.
Both are clear examples of access permissions not in alignment with position duties.
This unfortunately, increases the risk and opportunity for unauthorized usage of critical
data.
The company shows evidence of inadequacy regarding the scant role boundaries
placed. This does not coincide with the goals of RBAC, as it leans heavily on
standardized/defined role-permission correlations. For example, the customer
relationship management system can be accessed by a finance analyst, which isn’t an
average requirement for financial responsibilities. In addition, the HR department has
access to payroll data exceeding what may be required for their specific role. The
company also used shared accounts like the read-only reporting account. Using this
account minimizes accountability and contradicts best practices for controlling access.
This clearly demonstrates the inconsistency of positions not being thoroughly crafted to
mirror concrete business functions. This undermines the effectiveness of RBAC
execution.
, RBAC also advocates for using separation of duties. Separation of duties “Refers
to the principle that no user should be given enough privileges to misuse the system on
their own “(NIST). Based on the evidence, the separation of duties was inadequately
applied . For example, the IT admin has unrestricted access to company systems. This
makes it possible for the IT admin to be able to modify firewall rules without
authorization. In addition, the evidence reflects that there were no verification
mechanisms enacted. For example, in the events for privilege escalation, manual
assignments were made for the domain admin rights. Operational laxity on behalf of the
organization amplifies the company's exposure to both operational anomalies and
threats internally.
Constructive RBAC execution mandates efficient lifecycle management for all
user accounts, in addition to punctual deprovisioning and provisioning. Upon
investigation into the system logs, it was found that expired/terminated accounts were
still considered active in the system and still being utilized. This goes against the policy
that declares that access should be withdrawn within the first seven days of dismissal.
This example clearly shows the lapse in executing offboarding protocols and illuminates
an acute gap in access/identification management procedures. If the company doesn’t
enforce the appropriate lifecycle methods, they can’t guarantee that only legitimate
users can use the system.
RBAC relies heavily on rigorous governance, sanctioned workflows, recurrent
access reviews, and registered exceptions. The claimed policy reviews specifications for
registering exceptions and enacting reviews for access; however, operational traces
propose these methods weren’t followed on a consistent basis. For example, there was
evidence of unlogged escalations of privilege and unregulated firewall modifications
which showcases the lack of execution when it comes to oversight. Due to this, the
company's deployment of RBAC is deficient and null. There were pivotal gaps in
execution, ownership and tracking. To capitalize on the RBAC's benefits, the company
should define roles with clear specifications, ensure separation of duties and enforce
least privilege, and implement governance and assessment to enforce statutory access
controls.
A2. FOUR MISALIGNMENTS
Four misalignments that were clearly found in the user role matrix in contrast to
the principles of RBAC include: least privilege, the specification of roles/consistency,
separation of duties, and the management of the lifecycle.
AND ACCESS CONTROL POLICIES IN THE ATTACHED "SECURITY OPERATIONS
ARTIFACT" BY DOING THE FOLLOWING:
A1. SUGGESTED ACCESS CONTROL METHOD
The organization should utilize Role-Based Access Control (RBAC). RBAC is
congruent with the company's declared access control policies and the user role matrix
framework. “Role-based access control (RBAC) is a model for authorizing end-user
access to systems, applications and data based on a user’s predefined role” (Lindemulder
& Kosinski, 2026). The company currently follows this framework based on the
environment, as access is widely granted by position titles such as the IT administrator,
finance manager, and HR coordinator, and system/privilege is structured around the
roles. Structuring access with this approach allows RBAC to back consistency, scalability
and streamlined administration across the companies departments.
A core element of RBAC is the principle of least privilege. It is moderately
executed but it isn’t applied consistently throughout the company. The customer
support representative and the security analyst positions are properly limited to read-
only access, which highlights the attempt to minimize permissions to what is required to
perform the job. However, many violations subvert the least privilege principle. For
example, domain administrator privileges are assigned to a junior system administrator
and access to the payroll system can be granted to customer support representatives.
Both are clear examples of access permissions not in alignment with position duties.
This unfortunately, increases the risk and opportunity for unauthorized usage of critical
data.
The company shows evidence of inadequacy regarding the scant role boundaries
placed. This does not coincide with the goals of RBAC, as it leans heavily on
standardized/defined role-permission correlations. For example, the customer
relationship management system can be accessed by a finance analyst, which isn’t an
average requirement for financial responsibilities. In addition, the HR department has
access to payroll data exceeding what may be required for their specific role. The
company also used shared accounts like the read-only reporting account. Using this
account minimizes accountability and contradicts best practices for controlling access.
This clearly demonstrates the inconsistency of positions not being thoroughly crafted to
mirror concrete business functions. This undermines the effectiveness of RBAC
execution.
, RBAC also advocates for using separation of duties. Separation of duties “Refers
to the principle that no user should be given enough privileges to misuse the system on
their own “(NIST). Based on the evidence, the separation of duties was inadequately
applied . For example, the IT admin has unrestricted access to company systems. This
makes it possible for the IT admin to be able to modify firewall rules without
authorization. In addition, the evidence reflects that there were no verification
mechanisms enacted. For example, in the events for privilege escalation, manual
assignments were made for the domain admin rights. Operational laxity on behalf of the
organization amplifies the company's exposure to both operational anomalies and
threats internally.
Constructive RBAC execution mandates efficient lifecycle management for all
user accounts, in addition to punctual deprovisioning and provisioning. Upon
investigation into the system logs, it was found that expired/terminated accounts were
still considered active in the system and still being utilized. This goes against the policy
that declares that access should be withdrawn within the first seven days of dismissal.
This example clearly shows the lapse in executing offboarding protocols and illuminates
an acute gap in access/identification management procedures. If the company doesn’t
enforce the appropriate lifecycle methods, they can’t guarantee that only legitimate
users can use the system.
RBAC relies heavily on rigorous governance, sanctioned workflows, recurrent
access reviews, and registered exceptions. The claimed policy reviews specifications for
registering exceptions and enacting reviews for access; however, operational traces
propose these methods weren’t followed on a consistent basis. For example, there was
evidence of unlogged escalations of privilege and unregulated firewall modifications
which showcases the lack of execution when it comes to oversight. Due to this, the
company's deployment of RBAC is deficient and null. There were pivotal gaps in
execution, ownership and tracking. To capitalize on the RBAC's benefits, the company
should define roles with clear specifications, ensure separation of duties and enforce
least privilege, and implement governance and assessment to enforce statutory access
controls.
A2. FOUR MISALIGNMENTS
Four misalignments that were clearly found in the user role matrix in contrast to
the principles of RBAC include: least privilege, the specification of roles/consistency,
separation of duties, and the management of the lifecycle.
