Why do organizations continue to struggle with entitlement risk modeling? It boils down to risk being aligned to roles and role-based access. The irony is that roles were never intended to be risk models. They were once low-hanging fruit, a logical way to provide an early means of grouping users to entitlements and later associating risk to such groupings.

The Problem With Role-Based Risk Modeling

Let’s briefly step back and distinguish the difference between groups and roles. Groups are typically bundles of individuals or entitlements that can be managed together within a single system, application or common system framework.

Read full news article on Security Intelligence