Overall, this is a very comprehensive book that covers almost all aspects of RBAC.
What strikes me the most when reading this book, is the academic and theoretical nature of its contents. For example, the diagrams and especially the formulas, which are used to illustrate things, are likely difficult to grasp for a non-expert and will probably not elucidate the discussions in an average RBAC project. Since RBAC affects many different people in the organization, from business to IT, the subject should be presented as straightforward and simple as possible.
The book starts with a, useful, overview of access control. The different types, such as DAC `Discretionary Access Control' and MAC `Mandatory Access Control', are explained and compared with RBAC.
In one of the subsequent chapters the authors discuss how RBAC can be combined with other access control mechanisms. But the theoretical nature of the book is exemplified at the end of one of the discussions when it is stated that `To date, systems supporting both MAC and RBAC have not been produced, but the approaches discussed in this chapter show that such a system is possible.'
One of the most important chapters in my view is the one that deals with SOD `Segregation (or Separation) Of Duties'. SOD is an effective means to combat fraud.
Also useful, however brief, is the chapter, in which the authors discuss how RBAC can be used in regulatory compliance.
Throughout the book a number of frameworks, techniques and mechanisms are described how to integrate RBAC in real life environments. In the last chapter four arbitrarly chosen provisioning products (here called enterprise security administration products) are discussed, most of which, however, only offer moderate support for role modeling and RBAC administration. The products that do offer such support in a much better way, such as those from Bridgestream (now Oracle), Eurikify, BHOLD and Vaau (now Sun Microsystems), are surprisingly enough not mentioned at all.
What also is missing is a comparison of job functions and RBAC roles. Many people ask themselves how these relate to or differ from each other.
The examples, which are used, are almost exclusively from financial and health care organizations. Examples from government organizations as well as from educational institutes and production environments would have been helpful as well, since these kinds of organizations have their own unique RBAC requirements.
Rob van der Staaij
