What is role-based access control (RBAC)?
Role-based access control (RBAC) is a method of managing permissions in which rights are assigned to roles, and people or services are assigned to those roles. Each role carries the access needed for a job function and no more, which makes access easier to review and limits what any one account can do.
How does RBAC work?
An administrator defines roles, each with a set of permitted actions on a set of resources. Users, groups and service accounts are then mapped to roles. When someone changes job, their role assignment changes and their permissions follow. When an auditor asks who can delete backups, the answer is the membership of the roles that include that permission. The underlying idea is least privilege: an account should hold only the rights it needs.
Which roles does a backup environment need?
Backup software and storage systems ship with predefined roles, and the names vary. The separation that matters is between running backups, restoring data and changing or deleting things.
| Role | Can do | Should not be able to do |
|---|---|---|
| Backup operator | Start jobs, view status | Delete backups, change retention |
| Restore operator | Restore files and systems | Change jobs or repositories |
| Backup administrator | Configure jobs and repositories | Remove storage-level locks |
| Storage administrator | Manage capacity, users and buckets | Read or delete locked backup data |
| Auditor | View configuration and logs | Change anything |
| Service account for jobs | Write and read its own data | Administer the storage |
Why does role separation matter for ransomware?
Attackers go after the account with the most rights. When one administrator account can configure jobs, delete restore points and manage the storage, stealing it is enough to erase every backup. Splitting those abilities across roles means a single stolen credential reaches less, which reduces the administrative blast radius. The service accounts used by backup jobs deserve the same attention, because they are stored on the backup server. Limiting backup service accounts and separating admin accounts cover the practice.
What are the limits of RBAC?
RBAC decides who may ask for an action. It does not stop an authorized account from misusing its rights, and roles tend to accumulate permissions over time unless they are reviewed. It is therefore combined with other controls: multi-factor authentication for the people in privileged roles, the four-eyes principle for destructive actions and immutability so that stored restore points are protected whatever role an attacker obtains.
Frequently asked questions
What is the difference between RBAC and least privilege?
Least privilege is the goal of giving each account only the access it needs. RBAC is a way of organizing permissions that makes that goal manageable.
Should backup roles come from the production directory?
Mapping roles to directory groups is convenient, but it ties backup access to the directory's security. Local accounts for the most privileged roles avoid that dependency.
How often should role assignments be reviewed?
At least annually, and whenever staff join, move or leave.