Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) is the foundation for secure and efficient rights management in Information Security Management Systems. The fuentis Suite 4 implements a comprehensive RBAC concept that not only meets regulatory requirements but also enables practical work with different organizational structures and tenants.

Why is RBAC relevant?

• Compliance requirements
• Principle of least privilege: Each user receives only the rights they need for their tasks
• Auditability: Clear traceability of who can access which information
• Scalability: Efficient management even with complex organizational structures

Core Concepts of the RBAC System

The Three Pillars of Rights Management

1. Entities

Entities map the organizational structure of your company. They serve as:

• Logical separation of users and roles
• Organizational levels (e.g., corporate headquarters, national organizations, departments)
• Basis for multi-tenancy

Practice Tip: Use a consistent naming convention for entities, e.g., [Level]_[Location]_[Function] like HQ_GLOBAL for corporate headquarters or UNIT_DE_FINANCE for the German finance department.

2. Roles

The system distinguishes two role types:

Global Roles

• Predefined, non-editable permission sets
• Apply across entities
• Examples from fuentis Suite 4:
  • ISMS_INVENTORY_ANALYSIS_ACCESS: Access to inventory analyses
  • ISMS_RISK_ANALYSIS_ACCESS: Work with risk analyses
  • WFM_EDITOR: Workflow editing
  • TSKM_MANAGER: Task management with board functions
  • CATM_READER/EDITOR: Catalog management
  • ASSM_INTEGRATION_MANAGER: Configuration of external integrations

Custom Roles

• Flexibly customizable permissions
• Entity-specific assignable
• Ideal for fine-tuning access rights

3. Users

Users are:

• Managed via Keycloak as central authentication service
• Assigned to one or more entities
• Provided with global and/or entity-specific roles

Scopes and Multi-Tenancy

Scopes extend the concept of entities:

• Each entity has at least one scope
• Enable granular separation within an entity
• Basis for mapping information networks according to BSI IT-Grundschutz

Multi-Tenancy (Spaces) enables:

• Complete data isolation between tenants
• Individual configurations per tenant
• Cross-tenant access for collaborative work (controlled)

Practical Implementation of the RBAC Concept

User Lifecycle Management

Onboarding Process

1. Application: Formal request via IT service portal
2. Approval workflow: CISO/ISB approval required
3. Account creation:
   • Option A: Directly in Keycloak with subsequent synchronization
   • Option B: Via entity management with automatic email notification
4. Role assignment: Based on task profile
5. Training & documentation: Proof of briefing

Offboarding Process

1. Deactivation request: Upon departure/contract termination
2. Immediate access revocation: At termination date
3. Monthly cleanup: Review of inactive accounts

RACI Matrix for Typical User Groups

Role	Responsible	Accountable	Consulted	Informed
CISO	✓	✓	✓	✓
ISB	✓	✓	✓	✓
External Auditor	-	-	✓	✓
Inventory Manager	✓	-	✓	✓
Risk Owner	✓	-	✓	✓
IT Admin	✓	✓	-	✓
Task Manager	✓	✓	✓	✓

Module Permission Matrix

The fuentis Suite 4 structures permissions modularly:

ISMS Module

Structural Analysis

• Scopes: Read (SL), Edit (SB), Delete (FA)
• Target object groups: Full access for administrators
• Asset links: Limited editable

Protection Requirements Analysis

• Protection requirement values: Editing by SiKo editors
• Recommendations: Only usable by administrators
• Distribution: Administrator rights required

Modeling

• Building blocks/requirements/measures: Read access for all, editing from SB
• Custom elements: Creation from SiKo editor role
• Import/Export: Permission for editors and higher

Risk Analysis

• Threats/risks: Complete management from SB role
• Risk matrices: Exclusively administrators
• Controls: Assignment by editors, management by admins

Practice Tip: Define role profiles for recurring task areas. Example: A “Risk-Analyst” profile could combine the roles ISMS_RISK_ANALYSIS_ACCESS, ISMS_GAP_ACCESS and REPORTING_ACCESS.

Best Practices for RBAC Implementation

1. Map Organizational Structure Cleanly

• Use hierarchical entities for corporate structures
• Use scopes for functional separation
• Apply naming conventions consistently

2. Optimize Role Assignment

• Strictly follow principle of least privilege
• Conduct regular reviews (quarterly)
• Avoid overlapping roles
• Document deputy arrangements

3. Safely Integrate External Users

• Use separate roles with _EXT suffix
• Set up time-limited access
• Ensure NDAs before granting access
• Activate audit trail for external access

4. Manage Multi-Tenant Environments

• Ensure data separation through separate spaces
• Cross-tenant access only targeted and documented
• Implement tenant-specific workflows

5. Monitoring and Compliance

• Regularly evaluate access logs
• Document permission changes traceably
• Establish recertification of permissions
• Monitor segregation of duties (SoD)

Technical Implementation in fuentis Suite 4

Keycloak Integration

• Single Sign-On (SSO) for all modules
• LDAP/Active Directory connection possible
• Two-factor authentication optionally activatable
• Password policies centrally manageable

Synchronization and Consistency

• User sync between Keycloak and fuentis Suite
• Role propagation across all modules
• Caching mechanisms for performance optimization

Common Challenges and Solution Approaches

Problem: Complex Corporate Structures

Solution: Use hierarchical entities with inherited permissions. Parent units can define default roles for child units.

Problem: Temporary Project Access

Solution: Implement time-controlled roles with expiration date. Automatic deactivation after project end.

Problem: Compliance Evidence

Solution: Activate full audit log. Export permission matrix for audits.

Problem: Performance with Many Users

Solution: Role-based caching strategies. Asynchronous permission checks for non-critical operations.

Key Messages at a Glance

RBAC is mandatory: No ISO 27001 certification without structured rights management

Three-pillar principle: Entities + Roles + Users = complete access control

Flexibility through hierarchy: Global roles for basic functions, custom roles for special cases

Multi-tenancy ready: Complete tenant separation with collaboration option

Compliance by design: Automatic audit trails and traceable permission assignment

---

Additional Resources:

• Video Tutorial: RBAC Introduction