Balancing Trust and Risk in Access Control

Armando, Alessandro; Bezzi, Michele; Cerbo, Francesco Di; Metoui, Nadia

doi:10.1007/978-3-319-26148-5_45

Cited by 9 publications

(7 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, as will be seen from the subsequent discussion, there is no single accepted definition of what "concrete evidence" is. Trust can be calculated in several ways depending on the application context [71]. Examples include reputation models in which trust ratings from third parties are combined to give a trust rating; behavioural trust where trust is estimated based on a record of historical transaction.…”

Section: Risk and Trust In Caacmentioning

confidence: 99%

“…From an access control perspective, trust expresses the level of confidence the resource controller has in the user not misusing the resource(s) that she wants to access [71] and several trust-based CAAC methods have been proposed.…”

Section: Trust-based Caac a Well-known Definition Of Trust Is Given B...mentioning

confidence: 99%

“…Risk-based access control is more permissive than traditional policy-based systems which do not consider contextual risk in making a decision. Risk-based access control system may include a risk mitigation mechanism [71,82,83] to reduce the risk associated with a transaction to an acceptable level-generally an obligatory action to be taken before or after access is granted [84]. Many factors can be included in the risk calculation including contextual, situational/mission, and environmental factors as well as trustworthiness of the subject making the request.…”

Section: Risk-based Access Controlmentioning

confidence: 99%

“…Armando considered the balance between risk and trustworthiness (of the requestor) in access control [71]. He defines a trust and risk access control architecture as shown in Figure 6.…”

Section: Risk-based Access Controlmentioning

confidence: 99%

“…e numerous fuzzy logic risk-aware access control approaches could be adapted for ZT trust calculation, e.g., Manchala's [85] fuzzy trust matrix approach could provide a comprehensive access control approach that would map well to both NIST and Google's BeyondCorp ZT architectures. Moreover, Armando's the trust and risk-aware access control framework [71] points out an approach to implementing a trust/risk evaluation system. (7) [32] outline some such challenges including (i) How to capture and derive the relevant contextual conditions from IoT, fog and cloud environments?…”

Section: Application To Ztmentioning

confidence: 99%

See 4 more Smart Citations

SoK: Context and Risk Aware Access Control for Zero Trust Systems

Xiao¹,

Ye²,

Kanwal

et al. 2022

Security and Communication Networks

View full text Add to dashboard Cite

Evolving computing technologies such as cloud, edge computing, and the Internet of Things (IoT) are creating a more complex, dispersed, and dynamic enterprise operational environment. New security enterprise architectures such as those based on the concept of Zero Trust (ZT) are emerging to meet the challenges posed by these changes. ZT systems treat internal and external networks as untrusted and subject both to the same security checking and control to prevent data breaches and limit internal lateral movement. Context awareness is a notion from the field of ubiquitous computing that is used to capture and react to the situation of an entity, based on the dynamics of a particular application or system context. The idea has been incorporated into several access control models. However, the overlap between context-aware access control and zero-trust security has not been fully explored. In this SoK, we conduct a systematic examination of ZT, context awareness, and risk-based access control to explore the critical elements of each and to identify areas of overlap and synergy to enhance the operation and deployment of ZT systems.

show abstract

Section: Risk and Trust In Caacmentioning

confidence: 99%

Section: Trust-based Caac a Well-known Definition Of Trust Is Given B...mentioning

confidence: 99%

Section: Risk-based Access Controlmentioning

confidence: 99%

“…Armando considered the balance between risk and trustworthiness (of the requestor) in access control [71]. He defines a trust and risk access control architecture as shown in Figure 6.…”

Section: Risk-based Access Controlmentioning

confidence: 99%