Administrative Access Control Research Articles

Category-Based Administrative Access Control Policies

As systems evolve, security administrators need to review and update access control policies. Such updates must be carefully controlled due to the risks associated with erroneous or malicious policy changes. We propose a category-based access control (CBAC) model, called Admin-CBAC , to control administrative actions. Since most of the access control models in use nowadays (including the popular RBAC and ABAC models) are instances of CBAC, from Admin-CBAC , we derive administrative models for RBAC and ABAC, too. We present a graph-based representation of Admin-CBAC policies and a formal operational semantics for administrative actions via graph rewriting. We also discuss implementations of Admin-CBAC exploiting the graph-based representation. Using the formal semantics, we show how properties (such as safety, liveness, and effectiveness of policies) and constraints (such as separation of duties) can be checked, and discuss the impact of policy changes. Although the most interesting properties of policies are generally undecidable in dynamic access control models, we identify particular cases where reachability properties are decidable and can be checked using our operational semantics, generalising previous results for RBAC and ABAC α .

Qualitative and Quantitative Risk Assessment through IISRA Framework

Abstract: Information and communications technology (ICT) has expanded commercial potential beyond comprehension and has merged completely with organizations. In addition to its many advantages, ICT has disadvantages, such as cybersecurity risks, vulnerabilities, and a lack of adequate administrative access control that cybercriminals might take advantage of. Organizations are becoming more dependent on information security as a result of potential hazards brought on by advances in information technology, each of which has a different critical level based on its likelihood of happening and potential consequences. Methodologies for evaluating information security threats can be either quantitative or qualitative, depending on the Information outcome of their assessment. It is clear that both of the aforementioned choices have a number of fundamental flaws. In order to overcome them, this research paper focused on developing an Integrated Information Security Risk Assessment (IISRA) Framework that would be both more accurate and adaptable because existing approaches are frequently inappropriate and ineffectual due to the ongoing appearance of new sources of risks.

Modelling the Impact of Administrative Access Controls on Technical Access Control Measures

Almost all computing systems and applications in organizations include some form of access control mechanisms. Managing secure access to computing resources is an important but a challenging task, requiring both administrative and technical measures. This study examines the influence of administrative access control measures on technical access control mechanisms. Based on the four access control clauses defined by ISO/IEC27002, this study develops a model to empirically test the impact of access control policies on systems and applications control activities. The study employs Partial Least Square Structural Equation Modelling (PLS-SEM) to analyze data collected from 223 samples through a survey questionnaire. The results show that the greatest significant impact on applications and systems access control measures is through access control policies mediated by users' responsibilities and accountability and user access management activities. But the direct impact of access control policies on applications and systems access control measures is not significant.

Graph theory based representation of building information models for access control applications

Building information models are increasingly being utilised for facility management of large facilities such as critical infrastructures. In such environments, it is valuable to utilise the vast amount of data contained within the building information models to improve access control administration. The use of building information models in access control scenarios can provide 3D visualisation of buildings as well as many other advantages such as automation of essential tasks including path finding, consistency detection, and accessibility verification. However, there is no mathematical model for building information models that can be used to describe and compute these functions. In this paper, we show how graph theory can be utilised as a representation language of building information models and the proposed security related functions. This graph-theoretic representation allows for mathematically representing building information models and performing computations using these functions.

Decentralised privacy preservation in social networks

Social networks have become increasingly popular over the past decade, almost in all user communities. Users, in such networks, post a variety of their (personal) information on electronic profiles – initially accessible by their friends, yet ultimately accessible by strangers, no matter transitively or directly. This is a very convenient mechanism to facilitate information sharing but it is highly susceptible to privacy violations. Most social network infrastructures do not have a privacy management component and even when they do, it lacks expressiveness and is difficult to use. No social network provides a flexible user-centric privacy management component. This paper proposes a decentralised privacy management component for social networks, based on an existing flexible access control administration model. It allows users to customise access to each piece of their information for every group in their user hierarchy. Furthermore, users can control transitive (i.e., indirect) access to their information. Users can define any policies as long as they comply with system policies. The result is a uniform model capturing both data security needs and user privacy concerns.

Management of access control in information system based on role concept

Development of technology, progress and increase of information flow have the impact also on the development of enterprises and require rapid changes in their information systems. The growth and complexity of functionality that they currently should face cause that their design and realization become the difficult tasks and strategic for the enterprises at the same time. The informations systems store huge amount of data and allow to realize thousands of operations and business transactions on these data each day. In this case, it seems necessary to have the methods, techniques and tools that can make possibly the development of information system on level reflecting currently requirements. The paper describes the aspects of access control management in information systems based on the concepts of roles. This concepts can be presented by the role-based access control model and its extensions defined during last years. The practical implementation of presented concepts was given in the form of platform for access control management that can be used by system developers and security administrators to support their job in assuring the security of data stored and processed in an information system and assuring the global coherence of access control rules in the whole system. The proposed platform was based mainly on the approach connected with the access control model based on the role concept that reflects in the better way the company's organization on the access control level. The platform can be enrich with additional tool for access control administration with the use of other access control models.

A Context-aware Access Control Model for Pervasive Environments

Pervasive environments are dynamically changing environments with enormous amounts of information available for access from anywhere. This paper presents a framework for context-aware access control using threshold cryptography (CAAC-TC) where the administration of access control is distributed between different context services. CAAC-TC encrypts information using threshold cryptography where the private key is split up between the different context conditions which must be captured or realized. The idea here is that not all specified context conditions must be captured, and k captured contexts are enough. The management of access decisions is distributed among the different contexts. In CAAC-TC, multiple encryption layers can be specified where each layer is an encryption scheme of either n-out-of-n or k-out-of-n. Multiple layers simulate the use of an “AND" operator. Some of the main characteristics of CAAC-TC are decentralization, context error tolerance (distributed trust), extensibility, flexibility, and scalability.

Supporting dynamic administration of RBAC in web-based collaborative applications during run-time

The requirements for the efficient management of authorisations in web-based collaborative applications lead to new access control administration paradigms during run-time. The need for fine-grained and just-in-time access control can effectively be addressed by dynamic administration of authorisations, via either proper role or permission activation. In this paper, an authorisation architecture that is based on the Dynamically Administering Role-based Access Control (DARBAC) model, and provides access control and meta-access control capabilities, is presented. The paper describes the implementation of the components and the structure of the architecture within the.NET framework. The application of the implemented access control system is also demonstrated. Based on the results of this demonstration, a more detailed investigation of the benefits of the proposed approach, which are related to improvements in the administration of Role-based Access Control (RBAC) during run-time, is presented.

RBAC models — concepts and trends

A key function in any information security infrastructure is represented by access control which concerns the ways according to which users can access resources in a computer systems. Access control is one of the most pervasive security mechanisms in use today and is present in almost all systems, from operating systems to database management systems. Access control is usually based on access permits, also called authorizations, specifying which subjects can access which objects for performing which actions. Access control, however, imposes great administrative and architectural challenges and also requires careful design. In particular, a relevant problem, especially when dealing with large systems, is represented by the complexity of access control administration. Access control administration deals with assigning and revoking authorizations.

Access control: principle and practice

Access control constrains what a user can do directly, as well as what programs executing on behalf of the users are allowed to do. In this way access control seeks to prevent activity that could lead to a breach of security. This article explains access control and its relationship to other security services such as authentication, auditing, and administration. It then reviews the access matrix model and describes different approaches to implementing the access matrix in practical systems, and follows with a discussion of access control policies commonly found in current systems, and a brief consideration of access control administration.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>