Which one is better option for an admin from a usability point of view? Suppose if a system is supposed to authorize a user to have access (and different type of access like read only or read write) to only a few entities, then should the system put onus on the admin to give access to the user/role for those entities. Or, should the admin just specify what user is not supposed to have access to, assuming that by default he has access to everything.

In the first case, the admin is supposed to do a lot of work. Everytime a new user/role or a new entity is introduced in the system, admin has to sit down and make sure that this entity is made available to its users. It could be a lot of work for the admin if the application has a lot of roles and entities such as an ERP system.

In the second case, all users have full access to all the entities unless admin make decides to step in and put restrictions. It could lead to security loop-holes if restrictions are not placed on time.

Please let me know if there is already research done on this.

  • 3
    some keywords to google: whitelist vs blacklist approach. Always use whitelist :)
    – mkk
    Commented Mar 16, 2013 at 16:40

3 Answers 3


One key to consider - and I think a motivating factor with the move to prohibit access by default instead of permitting it - is the failure mode.

Consider, if an administrator fails to configure access for a given user, what happens?

For a system that uses "permit by default", the user gets access to too much, perhaps including privileged or confidential information, perhaps including the ability to reconfigure the system.

For a system that uses "deny by default", the user gets access to nothing. There's no inadvertent disclosure, no privacy breach.


When it comes to information security the general rule of thumb is to have everything locked down at first. It has evolved from the early days of internet when the analogy was the opposite. Back then everything was open until it was locked down. This made hacking easy and security breaches where a huge problem. So there were a shift toward having everything locked down.

There are some benefits one can't be overlooked. In order to open up a system to an audience, you need to have the knowledge to do so. This was not true before where one could start a server, connect it to the network and it was wide open.

The same goes for information. Have everything locked first, giving access only to those who should have access. Not the other way around.

  • While I agree that it would be safe to lock everything down first and then start distributing access to users, don't you think it will be too much work for the admin to do in case there are a lot of entities and roles? Also, what about restricting access to specific set of data in an entity, will the same rule of white-listing/black-listing applies? Commented Mar 18, 2013 at 18:00

I think that the best solution is to have an hybrid approach.

Give all the rigths, that doesn't compromise system security, as default. (Read on everything unless is classified).

Then the admin will grant write access if convenient.

Doing that, reduces the load of the admin (some entities have the access already defined) withouth compromising security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.