Compare RBAC and ABAC; what are the security implications of each approach?

• A. RBAC uses roles to grant access; ABAC uses attributes for context-aware control; RBAC is simpler; ABAC offers finer-grained and dynamic policies but is more complex to manage
• B. ABAC is simpler than RBAC
• C. RBAC uses attributes
• D. ABAC uses roles only

Answer: (C)

RBAC and ABAC differ in what they base access decisions on. RBAC grants permissions through roles: a user inherits the permissions assigned to the roles they hold. ABAC makes decisions from attributes: user attributes (department, clearance), resource attributes (data sensitivity), and environmental attributes (time, location), evaluated against policies that specify how those attributes combine to allow or deny access.

Security implications follow these foundations. RBAC is straightforward to implement and audit: you map roles to required privileges, and users gain access by being assigned appropriate roles. This makes it easier to enforce clear separation of duties and to review who has what rights. But it can be inflexible; when access needs change, you often have to adjust roles and role-permission mappings, which can lead to role explosion or gaps if roles aren’t maintained carefully. Fine-grained or context-aware decisions are hard to express with RBAC alone.

ABAC, by contrast, supports context-aware, fine-grained control. Access can adapt to who the user is, what they’re accessing, and the current context, enabling precise least-privilege enforcement and less reliance on many roles. However, this comes with governance and complexity: you must manage a wide set of attributes, keep attribute sources reliable, author policies correctly, and contend with performance and policy management overhead. In practice, many organizations blend both approaches to balance simplicity, auditability, and flexibility.