David Ferraiolo
- Co-authored Role-Based Access Controls (1992) with Rick Kuhn
- Work formed the basis of ANSI INCITS 359, the RBAC standard
- Long-running access control research programme at NIST
Bio
David Ferraiolo co-authored "Role-Based Access Controls" with Rick Kuhn, presented at the 15th National Computer Security Conference in October 1992. The NIST model that followed was adopted as ANSI INCITS 359 in 2004 and revised in 2012.
Profile built from public NIST and standards records.
Where their work shows up
The 1992 paper argued that access decisions in organizations follow job function rather than individual discretion, and that systems should model it that way. Vendors including IBM, Sybase, Secure Computing, and Siemens shipped products on that model within a couple of years, and the ANSI standard gave procurement something to require. See implementing RBAC in the enterprise and the best authorization tools ranking.
Related on Start with Identity
- ExpertCo-author of the Needham-Schroeder protocol
Michael D. Schroeder co-authored two of the foundational papers in this field within three years of each other: the 1975 design-principles paper with Jerome Sal
- ExpertCo-author of the NIST RBAC model
Rick Kuhn co-authored the 1992 NIST paper on role-based access control with David Ferraiolo and has worked on the model, its formalization, and its assurance ev
- ExpertDirector, CyLab; Professor, Carnegie Mellon University
Lorrie Faith Cranor directs CyLab at Carnegie Mellon and the CyLab Usable Privacy and Security Laboratory, founded the SOUPS symposium, and co-edited Security a