Yeah, honestly, we are doing that the other way around. So you heard a lot about what I wanted to talk in my presentation. So the panel was before my presentation. Now I can make it a little bit shorter because my dry runs were beyond the 20 minutes, I have to say.
So, as you can see, I keep talking about access control models. And we have the clicker over there, so I need that. And the idea is to reflect on that. What is an access control model? What are the basics? And how can it help us? We heard already a lot in the panel, but I want to structure it a little bit for you so that you can take something with you home.
First, we want to face some facts. One fact is modern and dynamic authorization is already a trend. We cannot deny that. We have seen that last EIC. We have seen the EIC before. It is a trend for a couple of years. AI and agentic AI is speeding that up, making that more important, certainly. That means, as well, that we have new access control models popping up. And with that, we have new acronyms. We just heard it. There are some around.
Still, the main question stands. How do we handle authorization in the future? We heard that in the keynotes. Agentic AI, how do we handle them? We don't really have an answer yet, but we have a lot of access control models. Let's reflect on that. Authorization has a long history.
So, we have a couple of control models that are there for decades. It evolved over time. If you are interested in the history, I've linked one research paper there, written by a colleague, which is quite good to get an overview. But what we can certainly say is that RBAC, ABAC, PBAC are the most popular access control models right now. Probably. I'm convinced of that. RBAC is the most popular one, basically due to the history. It is easy to understand. It is used for decades. It's pretty much everywhere at the moment, and we see a shift. And we talked about that in the panel.
If you are trying to compare the different access control models, there are a lot of different perspectives that you need to look at. So, I have a list here, like scalability, auditability, Roland said expressiveness or something. You need to be aware what your access control model can do for you, if you want to use it. RBAC is not able to solve every use case. ABAC neither.
So, that is important to understand. For the experts in the room, I've also hidden one acronym in that cloud that is not an access control model.
So, I'm curious if you are able to find it. But we are not doing it yet, now.
So, let's continue. What we learned is we have a changing environment. We have heard that in the keynotes. What we can currently see is we need to speed up. Scalability, decision speed, automation, crucial. But those are not the things that RBAC was built for.
So, that is definitely a challenge. We need to rethink where we are. And we definitely need to think if our access control model or all the access control models that we use are able to deliver up to the expectations.
For that, we need to understand a little bit the authorization terms, I would even say. We need to understand what is coarse-grained, what is fine-grained.
So, my idea is that we go through it quickly. Coarse-grained means I make an access decision based on a single information. On the other hand, I have fine-grained. That means I have more decision information to make that decision.
Example, am I in an AD group? Yes or no, that's a coarse-grained decision. When I add more information to that, meaning, am I in an AD group? Am I in Germany? Have I a certain position? If I add all that together, I have a fine-grained decision. Second thing is static versus dynamic access control. What kind of information do I use? AD group membership is very static. It doesn't change very often. On the other hand, I have attributes that change regularly. Every second, probably.
So, what kind of information can I use? We all know the standing privileges. We all know how AD groups work.
Then, when it comes to the decision itself, we need to reflect, is that a decision at administration time, or are we making our decisions in runtime? So, do I do the lifting in advance, like being part of an AD group, or do I evaluate that in real time, at runtime? The interesting thing for access control models is, all of these can be pretty much freely combined.
So, I can have a coarse-grained decision at administration time with static information, which is pretty ARBEC. I could also do a fine-grained decision with static information at real time. And I could combine them very freely. I could keep making examples.
So, you really need to understand, what is my access control model doing? And that brings me to the timing aspect here.
So, the timing aspect is, that there are three times in every access decision. We have the administration time, that is basically in advance of an access. You can think of it as being added to an AD group. This decision is made in advance. But the problem with these decisions at administration times, is that you cannot reflect real-time information. You cannot reflect changing context in the end. That changes when we come to the real-time aspect. And the real-time aspect splits in two parts. The first part is the session initialization.
So, that's the moment where the decision is made. Where the magic happens. Where all the information is evaluated, and the system says, yes or no. And that includes static information, that includes dynamic information.
So, I was talking about the changing context. At initialization, this is like a snapshot. At that very moment where we make that decision, we make that decision.
So, reflecting changing context is something that we can do here in the second part, the session management. So, what we need to do, we need to monitor the access over the whole session. And that's where we reflect changing context. And if the context changes, we need to react. Step up or terminate the session if it gets worse. The post-event time is interesting, but not that interesting for access control models. This is where we do the monitoring, the logging, the reporting.
There, we are able to learn after the access happened. The learning part, however, is very important for the feedback loop. I think you said that, that we can use AI to optimize our rules and our policies. And this is what we learn here in the post-event time. The feedback loop is very important if we go into a dynamic world. But that means that, as you can see here by the arrows, there are decisions at administration time. There are decisions in real time. They have advantages. They have disadvantages.
When we think about access control models, however, all of them need to touch four dimensions. Identity, action or intention, object, and the context part. The identities are the digital representation of the actor. Action and intention, I think that's very clear. What are you trying to do when you get access to the data? And the last one here in the upper area is object and resource. This is what we are trying to access. This is the digital representation of where we are trying to go.
The interesting thing about context is that context is something that is linked to the other three dimensions, at least very, very often. So you link context to the identity. You link context to the object. You link context to the intent or the actual action.
However, every access control model needs to touch these four dimensions. If it doesn't, it's probably not an access control model. So let me give you an example.
You see, we still have the four dimensions here, and I've made a very simple example. So Anna wants to access the folder sales for Germany. Very simple example. There's an intention. She wants to access the folder. Then I've given you three different access control models, and the first one is focusing on cost, grant, and admin time. So that changes the perspective a little bit. Anna is added to the AD group sales for Germany. This is a classic RBAC approach. We have a single information, and this is giving us access. That's the AD group membership.
Now let's change that a little bit towards a fine-grained access control model. Then I need more decision criteria to make that decision. So thinking about the same example, I would say Anna, who is a data analyst from Germany, is added to the AD group. But this adding her to the AD group is based on two more information that is reflected. It is the data analyst and Germany. The third access control model here, the third example, is then going towards the real-time and fine-grained aspect. So I have more information that I make my decision on, but in real time.
So I'm not adding anyone to the AD group to give access, but I evaluate that at runtime. Again, I have the same information down here, but the question is changing. So at the point of access, at session initialization, I basically ask, is Anna in Germany? And is she part of the AD group? I could also ask, is she a data analyst, by the way? I could even add that. Since it is fine-grained, I can add criteria. It would make the policy a little bit more complicated probably, but that's possible.
The important thing that I want to show here is, first of all, that the context is usually linked to one of the other dimensions. And the second thing is, and that's more important, every access control model has a focus and is able to explain or is able to map the same example in a different way. And that makes it quite clear what I just said like three minutes ago or something. Every access control model must touch these four dimensions.
Identity, action, object, and the context. If it is not touching these four dimensions, it's either not an access control model or it's still incomplete. And you can use that for the word cloud to find the one that is not an access control model. What you need to be careful with when it comes to access control model and the four dimensions is, some of the access control models, they have sometimes a very weak focus on some of the dimensions that you are barely able to see. Those are not incomplete. They are sometimes just very focused on one of the other dimensions.
We have talked about ABAC and RBAC a lot in our panel already. But when we think about these two as an example for focus, we can see how ABAC and PBAC, which are very similar to each other, are very much focused on the heavy lifting part. So scaling is the idea, transforming business logic into policies. But when it comes to the other dimensions, some of these models are not that much focused on the other dimensions. So most of the ABAC and PBAC models do not tell you anything about the object besides it is there. RBAC on the other side is quite the opposite of the ABAC and PBAC approach.
So when we think about RBAC, and we are thinking about RBAC for decades now, what is it doing? It is creating roles. We are bundling up the entitlements. We are enhancing these roles and objects to make our administration easier because we understand what we are doing.
However, when we think about the classic RBAC approach, where we say we have a job title and we give the role to the person that has the job title, we are rather limited to the other dimensions. If it becomes even worse, we say we provision that manually, which is, as I said, worse. So the essential point here is that we can use both models together to get to a better level of authorization. The second thing that we learn from that is that the access control models need to improve.
RBAC will probably not survive in the long run if it is not changing towards something that we need, that we can combine. So let's think about what we currently know. We know that the use cases that we currently have and the applications that we have in place are not going away from this day to the next day. So the stuff that we currently have is not changing. What we know is that there are some use cases where the classic and popular access control models are struggling with. I have as an example here the unstructured data parts, like Teams, like SharePoints.
Everyone that is trying to do that with RBAC, good luck. What we know is that RBAC is the most important and most popular access control model right now, at least from what I've seen. And what we know is that the use cases that we have for real-time authorization, for the scaling part, for the dynamic authorization, are quite limited at the moment. So there are some.
Yeah, there are some. The point is, this is what we knew. The stuff is changing. We need to rethink where we are right now. What we see is there are new applications coming that rely on external authorization. What we see is and what we hear here on the conference is agentic AI will be a whole new challenge for us that we probably can solve with the access control models that we have in place at the moment. So one thing that we can observe is that zero trust is no longer a buzzword. It's becoming reality, and very quickly.
So that means, and that's what I'm convinced of, we need to combine these access control models, the possibilities that we have to handle these cases. And that is what makes dynamic authorization a very important trend at the moment. Not because it's fancy, and we have some experts that are telling you about that. It's because out of necessity, you need it out there. You are limited with only RBAC, for example. So we need to rethink that and work on that. So what I want you to take away today are four points. The world is changing, that's for sure, but it's not changing from today to tomorrow.
You have a little bit of time, and the access control models that you have, they will keep delivering for the use cases you use them. The second thing is you need to be aware that there are use cases out there that are complex. You will need to combine these access control models to get ahead of what we are facing. From an authorization perspective, and that's the third thing, I can tell you, agentic AI is the most unpredictable NHI, but not the only one. There are others out there, and I mean, we keep talking about agentic AI. It's not everything. There are other challenges there.
And the last thing is that dynamic authorization will change how we do authorization in the future. If we solve that for agentic AI, it will improve the overall authorization maturity for all other kinds of identities. And that's pretty much my conclusion, so thank you for listening. Thank you. Thank you so much. Thank you. I have a quick question. If we have the time. If we have the time, just one minute. Let's say I'm part of an enterprise using RBAC, and I want to transform towards something more dynamic. What would be your recommendation, like the first step?
Because it can be a long way, so how do I push that? First of all, I would check whether my use cases are properly covered first. So what do I need? What is the access control model that can support me with these use cases? And then we have that in the panel. Roland said that. We can think about the access control model that we need. I need to find the access control model that can help me with the heavy lifting, for example.
When I'm an RBAC-heavy organization, I probably have my issues with scalability, basically provisioning the fundamentals, the 50% of my access rights that everyone should have. But as I said, it depends where I'm trying to go. If we think about agentic AI, I think pretty much every organization is facing the step towards real-time decision-making. So that would probably be the next step. But that's the strategic question that can take different directions, I would say.
All right, thank you so much. Thanks again.
