Precursors of Role-Based Access Control Design in KMS: A Conceptual Framework

Abstract

Role-based access control (RBAC) continues to gain popularity in the management of authorization concerning access to knowledge assets in organizations. As a socio-technical concept, the notion of role in RBAC has been overemphasized, while very little attention is given to the precursors: role strain, role ambiguity, and role conflict. These constructs provide more significant insights into RBAC design in Knowledge Management Systems (KMS). KMS is the technology-based knowledge management tool used to acquire, store, share, and apply knowledge for improved collaboration and knowledge-value creation. In this paper, we propose eight propositions that require future research concerning the RBAC system for knowledge security. In addition, we propose a model that integrates these precursors and RBAC to deepen the understanding of these constructs. Further, we examine these precursory constructs in a socio-technical fashion relative to RBAC in the organizational context and the status–role relationship effects. We carried out conceptual analysis and synthesis of the relevant literature, and present a model that involves the three essential precursors that play crucial roles in role mining and engineering in RBAC design. Using an illustrative case study of two companies where 63 IT professionals participated in the study, the study established that the precursors positively and significantly increase the intractability of the RBAC system design. Our framework draws attention to both the management of organizations and RBAC system developers about the need to consider and analyze the precursors thoroughly before initiating the processes of policy engineering, role mining, and role engineering. The propositions stated in this study are important considerations for future work.

From Theory to Practice: Implementing Effective Role-Based Access Control Strategies to Mitigate Insider Risks in Diverse Organizational Contexts

“…The Structural Equation Modeling (SEM) analysis reveals insightful relationships, notably the significant reduction of insider threats attributed to RBAC effectiveness, supporting hypothesis H1. This finding aligns with the literature emphasizing the strategic importance of access control mechanisms in mitigating such threats [24][28] [58]. The negative impact of implementation challenges on RBAC's effectiveness (H2) underscores the nuanced barriers organizations face, especially the administrative and technical hurdles that can diminish the system's efficacy.…”

“…Permissions are access rights or privileges granted to roles, enabling them to perform certain operations. Sessions represent instances of users operating within the system under specific roles, effectively linking users to their roles temporarily [24]. User-role assignments include mappings between users and roles and determining which roles a user can assume in a session.…”

“…Although RBAC is widely recognized for its effectiveness in managing access controls, its implementation is challenging, as accurately defining roles and permissions can be complex and time-consuming, particularly in organizations with intricate operational structures [26]. The dynamic nature of modern work environments, characterized by frequent changes in job functions and responsibilities, necessitates continual updates and revisions to role definitions and assignments [24][27]. Mayeke et al [13] assert that emerging trends in RBAC research and application focus on enhancing its adaptability and intelligence.…”

“…Role-Based Access Control (RBAC) is considered a strategic framework pivotal in mitigating insider threats, a pressing concern for organizations worldwide [24] [28]. It employs several strategic mechanisms that effectively reduce the risk of insider threats [29].…”

“…Furthermore, defining and managing roles can be difficult, particularly in dynamic environments where job functions and workflows evolve rapidly [24] [52]. The initial phase of accurately mapping organizational roles to specific permissions is critical.…”