Invalidating policies using structural information
Conference paper
Kammueller, F. and Probst, C. 2013. Invalidating policies using structural information. IEEE CS Security and Privacy Workshops, SPW, WRIT'13.
Type | Conference paper |
---|---|
Title | Invalidating policies using structural information |
Authors | Kammueller, F. and Probst, C. |
Abstract | Insider threats are a major threat to many organisations. Even worse, insider attacks are usually hard to detect, especially if an attack is based on actions that the attacker has the right to perform. In this paper we present a step towards detecting the risk for this kind of attacks by invalidating policies using structural information of the organisational model. Based on this structural information and a description of the organisation's policies, our approach invalidates the policies and identifies exemplary sequences of actions that lead to a violation of the policy in question. Based on these examples, the organisation can identify real attack vectors that might result in an insider attack. This information can be used to refine access control system or policies. |
Conference | IEEE CS Security and Privacy Workshops, SPW, WRIT'13 |
Publication dates | |
2013 | |
Publication process dates | |
Deposited | 23 Apr 2015 |
Output status | Published |
Language | English |
https://repository.mdx.ac.uk/item/8515v
41
total views0
total downloads1
views this month0
downloads this month