| Status | ||||
|---|---|---|---|---|
|
Question
What is a Reasonable Optimal Minimum Cardinality Requirement for Roles ?
Short Answer
It depends. 5 may be a good guiding threshold. .
Full Answer
The economic impact of RBAC
Role management has a total cost. To estimate this cost, we should considering the full lifecycle of roles, the time spent by role owners and role engineers to plan, model, configure, maintain, and eventually delete roles and the role management IT infrastructure. Let’s call this cost the RBAC cost.
Similarly, we
Even though some roles require more maintenance than others, we may assume that cost to be fixed for the sake of simplicity.. Similarly, role-based access management creates value as it brings productivity and security benefits to the organization. For a detailed economical study of RBAC, cf. Gallaher et al., 2002).
In theory, the optimal minimum cardinality requirement for roles is the value that optimizes the economical impact of RBAC, i.e. value - cost.
The cost of minuscule roles
Asking for an optimal minimum cardinality requirement implies that too small roles may have a negative economical impact, that is to say the productivity and security benefits it brings to the organization are lower than the role’s cost.
Are role management costs identical across organizations?
The value of minuscule roles
Are teams and functions of identical sizes across organizations and industries?
...
Literature Review
...
Conclusion
…