Comparative Analysis of Multi-Factor Authentication and Role Based Access Control in Cloud Data Security
Author
Vimalraj V, Dr. V. Maria Antoniate Martin
Abstract
Cloud computing has made data storage and processing scalable and affordable, but it has also moved sensitive data outside an organization's physical perimeter. Identity has therefore become the main security boundary. Two controls are widely deployed to protect it: Multi-Factor Authentication (MFA), which verifies who is requesting access, and Role-Based Access Control (RBAC), which governs what an authenticated user may do. Although often discussed together, they address different threat classes and are seldom compared directly. This paper presents a qualitative, criteria-based comparative analysis of MFA and RBAC in cloud data security. Both are evaluated against six criteria: threat coverage, protection against credential compromise, protection against insider misuse, usability, administrative overhead, and regulatory alignment. The analysis shows that MFA is most effective against external credential-based attacks, while RBAC is most effective at limiting damage from insider misuse and over-privileged accounts. Neither is sufficient alone. A layered model combining both, supported by periodic access reviews, gives the strongest protection.
Keywords
Multi-Factor Authentication (MFA), Role-Based Access Control (RBAC), Cloud Security, Authentication, Authorization, Data Protection, Least Privilege
Full Text:
References
- Mell and T. Grance, "The NIST Definition of Cloud Computing," NIST Special Publication 800-145, National Institute of Standards and Technology, 2011.
- Ometov, S. Bezzateev, N. Mäkitalo, S. Andreev, T. Mikkonen and Y. Koucheryavy, "Multi-Factor Authentication: A Survey," Cryptography, vol. 2, no. 1, art. 1, 2018.
- S. Sandhu, E. J. Coyne, H. L. Feinstein and C. E. Youman, "Role-Based Access Control Models," IEEE Computer, vol. 29, no. 2, pp. 38–47, 1996.
- F. Ferraiolo, R. Sandhu, S. Gavrila, D. R. Kuhn and R. Chandramouli, "Proposed NIST Standard for Role-Based Access Control," ACM Transactions on Information and System Security, vol. 4, no. 3, pp. 224–274, 2001.
- Bonneau, C. Herley, P. C. van Oorschot and F. Stajano, "The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes," in Proc. IEEE Symposium on Security and Privacy, 2012, pp. 553–567.
- A. Grassi et al., "Digital Identity Guidelines: Authentication and Lifecycle Management," NIST Special Publication 800-63B, 2017 (and subsequent revisions).
- Dmitrienko, C. Liebchen, C. Rossow and A.-R. Sadeghi, "On the (In)Security of Mobile Two-Factor Authentication," in Financial Cryptography and Data Security, 2014.
- C. Hu et al., "Guide to Attribute Based Access Control (ABAC) Definition and Considerations," NIST Special Publication 800-162, 2014.