In the White Paper by Kroll, the interesting recommendation is the fundamental rule for determination as to who should be granted access to protected information is the “NEED TO KNOW” concept. For example, in the military a soldier can have Top Secret clearance. But because his current job description does not require the access to Top Secret information, some security managers will downgrade that person's access level to secret based on both the duty position and description or for adverse actions.

With role-based access control, access decisions are based on the roles that individual users have as part of an organization. Users take on assigned roles (such as doctor, nurse, teller, manager). The process of defining roles should be based on a thorough analysis of how an organization operates and should include input from a wide spectrum of users in an organization (Ferraiolo and Kuhn, 1995).

I will continue to use the case of Army PFC Manning who is currently facing charges for espionage. PFC Manning is accused of downloading over 500, 000 military reports and releasing the information to Wikileaks. PFC Manning held a grudge with his unit and decided to retaliate by disclosing classified information that could possible cause devastation to the lives of many. This young soldier was known for having mental problems and was, at some point, viewed as a threat to himself and others. This is where his chain of command needed to exercise command authority notifying the security manager suspend Manning's access to classified information.

By controlling users' access according to their roles and the attributes attached to those roles, the RBAC model provides a companywide control process for managing IT assets while maintaining the desired level of security (Grueling and Lord, 2003). Manning could have been reassigned to working in the company headquarters, but still have access to the organization's classified information.

Ferraiolo, D. and Kuhn, R. (1995). An introduction to Role-Based Access Control. Retrieved from: http://csrc.nist.gov/groups/SNS/rbac/documents/design_implementation/Intro_role_based_access.htm

Grueling, T. and Lord, R. (2003). How role-based access control can provide security and business benefits. Retrieved from http://www.computerworld.com/s/article/86699/How_role_based_access_control_can_provide_security_and_business_benefits

McQuade, S. C. (2006). Understanding and managing cybercrime. Boston, MA: Pearson.