A trust-and-risk aware RBAC framework

Abstract

Insider Attacks are one of the most dangerous threats organizations face today. An insider attack occurs when a person authorized to perform certain actions in an organization decides to abuse the trust, and harm the organization. These attacks may negatively impact the reputation of the organization, its productivity, and may produce losses in revenue and clients. Avoiding insider attacks is a daunting task. While it is necessary to provide privileges to employees so they can perform their jobs efficiently, providing too many privileges may backfire when users accidentally or intentionally abuse their privileges. Hence, finding a middle ground, where the necessary privileges are provided and malicious usage are avoided, is necessary. In this paper, we propose a framework that extends the role-based access control (RBAC) model by incorporating a risk assessment process, and the trust the system has on its users. Our framework adapts to suspicious changes in users' behavior by removing privileges when users' trust falls below a certain threshold. This threshold is computed based on a risk assessment process that includes the risk due to inference of unauthorized information. We use a Coloured-Petri net to detect inferences. We also redefine the existing role activation problem, and propose an algorithm that reduces the risk exposure. We present experimental evaluation to validate our work.

A Multidimension Taxonomy of Insider Threats in Cloud Computing

“…Crampton & Huth [31] discuss the limitation of detecting insiders using access control techniques, they emphasised the insufficiency of relying only on static access and predefined access rules, and they show the press need for considering the context in the access rules. Also we recommend investigating dynamic access control approaches such as Attribute-Base Access Control (ABAC), Risk based adaptive access control [32], and Trust based access control [33]. However, these approaches need be adopted for cloud environments.…”

Formal Modeling and Verification of Opportunity-enabled Risk Management

“…The model we propose is not only focused on information sharing and covers more aspects of risk management. Baracaldo and Joshi [16] extend the role-based access control model with risk and trust management in order to prevent insider threats that are caused by internal, legitimate users. They evaluate all the risk parameters statically, while in our model risk is estimated dynamically in real-time at request time.…”

A Model for Trust-Based Access Control and Delegation in Mobile Clouds

“…Recently, researchers have proposed the notion of risk-adaptable access control models [9,14,13] and trust-based access control models [7,4,23] to facilitate dynamic adaptation of access control policies based on operational needs and situational awareness. A recent work [1] combines these two philosophies into one comprehensive model. However, none of these works address the problem of delegation in mobile cloud systems.…”