Three systems, three needs
A school app, a shop and a hospital all keep data. All three must let the right people in.
The school app lets parents see homework. The shop lets a partner company check stock. The hospital lets a doctor read a patient file, but only on the ward.
The needs are different. So the method of access must be different too.
Key words
| Word | What it means | Example |
|---|---|---|
| Platform | A kind of system that uses the data: a phone app, a website, a partner system. | An app and a website |
| RBAC | Role-based access control. Permissions belong to roles. | Doctors may read files |
| RuBAC | Rule-based access control. A rule such as the time or place decides. | Only on the ward |
| API | A door that lets one program ask another for data. | A stock check by a partner |
| Sensitive data | Data that could harm a person if it is seen by the wrong people. | Health records |
| Access requirement | What a job needs: who, how often, how safe. | Only on the ward |
The cells students fill in are left blank in this preview.
Benefits and drawbacks of each method
| Method | Benefit | Drawback |
|---|---|---|
| RBAC | Simple. Easy to give a new person the right access. | Not flexible. Too many roles become a mess. |
| RuBAC | Flexible. Can use time, place or device. | Rules are hard to write and to test. A wrong rule locks out the right person. |
| API | One safe door for many platforms. The data stays in one place. | Takes time to build. A weak API is a risk for all platforms. |
The cells students fill in are left blank in this preview.
Quick check: benefit or drawback?
Have a go
Quick check: benefit or drawback?
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Start with the need
Before you pick a method, ask four questions.
Who needs the data? How many platforms use it? How sensitive is it? Do you need a rule about the time or the place?
The answers point to the method. This is how you make a judgement.
Three cases
| System | Who needs it | Platforms | Sensitive? | Rule needed? |
|---|---|---|---|---|
| School app | Parents, teachers, students | Phone and website | Some | No |
| Shop stock | Staff, a partner company | Website, partner system | No | No |
| Hospital files | Doctors, nurses | Ward screens, phones | Very | Yes: only on the ward |
The cells students fill in are left blank in this preview.
Extra: Two more ideas you may hear
| Idea | What it is | Benefit | Drawback |
|---|---|---|---|
| Direct access | A program or person connects to the data store itself. | Fast and simple for one trusted program. | Risky. Anything that connects can see everything. |
| Audit log | A record of who looked at or changed data, and when. For example: Dr Khan read file 12 at 10:15. | You can find out who saw sensitive data. | It shows misuse after it happens. It does not stop it. |
The cells students fill in are left blank in this preview.