Event Driven Applications
Review, Research, and Discussion
- Why is access control important?
- We dont want users to access data that we dont want manipulated or accessed.
- Describe an application that would need access control.
- Any application that has user accounts, such as banking apps.
- What is a role used for?
- To assign capabilities to a users account to manipulate or access data.
- Why is role based access control more scalable than discretionary or mandatory access control?
- role based is more flexible in the sense that you can assign as much or as little access to a group of users as you want. discretionary requires individual management, so it would be hard to managage as the site scaled in size. Mandatory has a heirarchal system, and its strict in the sense that it has trouble adding roles that dont fit within the heirarchy.
Vocabulary
- Authorization
- Different from authentication (which is essentially a service used for users to prove who they are), authorization is what access rules are for an authenticated user and either grants or refuses resource access. A user can be authenticated, but not authorized.
- Role Based Access Control
- Also considered Non-Discretionary Access Control, where access is based on a user’s job function with an organization. Permissions are granted to roles rather than specific users or assets.
- Capabilities
- levels of access that employees have to the network. E.g. admin, editor, writer, generic user, or which roles are able to create, read, update, or delete.