Should an admin decide what users can do, or should he decide what not to do?

Question

Which one is better option for an admin from a usability point of view? Suppose if a system is supposed to authorize a user to have access (and different type of access like read only or read write) to only a few entities, then should the system put onus on the admin to give access to the user/role for those entities. Or, should the admin just specify what user is not supposed to have access to, assuming that by default he has access to everything.

In the first case, the admin is supposed to do a lot of work. Everytime a new user/role or a new entity is introduced in the system, admin has to sit down and make sure that this entity is made available to its users. It could be a lot of work for the admin if the application has a lot of roles and entities such as an ERP system.

In the second case, all users have full access to all the entities unless admin make decides to step in and put restrictions. It could lead to security loop-holes if restrictions are not placed on time.

Please let me know if there is already research done on this.

Answer 1

One key to consider - and I think a motivating factor with the move to prohibit access by default instead of permitting it - is the failure mode.

Consider, if an administrator fails to configure access for a given user, what happens?

For a system that uses "permit by default", the user gets access to too much, perhaps including privileged or confidential information, perhaps including the ability to reconfigure the system.

For a system that uses "deny by default", the user gets access to nothing. There's no inadvertent disclosure, no privacy breach.

Answer 2

When it comes to information security the general rule of thumb is to have everything locked down at first. It has evolved from the early days of internet when the analogy was the opposite. Back then everything was open until it was locked down. This made hacking easy and security breaches where a huge problem. So there were a shift toward having everything locked down.

There are some benefits one can't be overlooked. In order to open up a system to an audience, you need to have the knowledge to do so. This was not true before where one could start a server, connect it to the network and it was wide open.

The same goes for information. Have everything locked first, giving access only to those who should have access. Not the other way around.

Answer 3

I think that the best solution is to have an hybrid approach.

Give all the rigths, that doesn't compromise system security, as default. (Read on everything unless is classified).

Then the admin will grant write access if convenient.

Doing that, reduces the load of the admin (some entities have the access already defined) withouth compromising security.