CB Defense: Can Default RBAC Roles be Edited or Deleted?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Now that customization of RBAC roles is available, can the default roles be edited or deleted?

Environment

• CB Defense PSC Console: March '19 Release and later (0.45)

Resolution

No, the default roles cannot be edited or deleted

Additional Information

• The default roles are static templates
• There is no security risk in roles existing with all permissions granted because role permissions are hierarchical
• The hierarchical nature of role permissions prevent any user from assigning permissions to a role that are not assigned to their own role
• For example, a User that is assigned permission to Manage Roles and Users but not Connectors cannot assign permission to manage Connectors