A Novel Inference-based Approach to Evaluate Failure Interdependency in Access Control Models

Abstract

Demands for better design and analysis of access controls require system-level evaluation models that can facilitate a quantitative and consistent study of operational capabilities and economics of access control implementations. Previous works on access control models are mainly centered on the access interaction between system subjects and objects with respect to rights, addressing their basic security goals, thus failing to address other dependability attributes. To address this shortcoming, we first propose the abstraction of a computing system into: objects and rights of subjects (called in this paper assets and controls, respectively) to study the unavoidable failure interdependency between these two classes, a perspective that can be a basis for various failure-related assessment methods. We then propose a modeling technique that probabilistically captures the interaction between assets and controls into a graph theoretic paradigm; we specifically show how Bayesian Networks (BNs) can model this dilemma. This paper presents the proposed abstraction, modeling formalism, and associated notation, along with a demonstration example of various useful inferences and further research directions.