Informed Privilege-Complexity Trade-Offs in RBAC Configuration

Abstract

Role-Based Access Control (RBAC) has the potential both to simplify administration and improve an organization's security. But for non-trivial configurations, there is a conflict between defining fine-grained roles which adhere to the principle of least privilege, and coarse-grained roles which simplify administration by reducing configuration complexity. In this paper we propose OnPar, a multi-objective role mining approach which introduces minimization of unnecessary privilege as a role mining objective, along with an associated unnecessary privilege metric. These allow an RBAC configuration's level of adherence to the principle of least privilege to be reasoned about and traded off against other objectives, including minimization of configuration complexity. A key feature of our approach is the elimination of user tuning of global optimization weights. We show experimentally that this tuning typically leads to the evaluation of sub-optimal candidates, while still missing many optimal candidates. To avoid these issues we leverage Pareto optimality and introduce multi-stage Pareto filtering and the hypervolume indicator to role mining. Their use allows OnPar to efficiently select a small set of candidates for evaluation by the administrator, which are equal best and representative of the full range of trade-offs that were found. Our experimental results demonstrate the effectiveness of this approach across a wide range of input configurations. CCS CONCEPTS • Security and privacy → Information accountability and usage control; Access control; • Information systems → Data mining.

Intelligent Process Automation and Business Continuity: Areas for Future Research

“…However, the phenomena that lead to disruptions are very complex and non-linear and no satisfactory model has yet been developed to avoid them or predict when they will occur and what kind of impacts they will cause. For this reason, the ML and AI techniques associated with RPA/IPA have begun to be widely used in recent years [8,10,26,85,104,115,131,145,148,152,176,201,204,215,217,260,272,278,290,295,299,304,311,312,314,325,[329][330][331][352][353][354][355][356][357].…”

Attribute-Based Access Control Policy Generation Approach from Access Logs Based on the CatBoost

“…Thus, this approach improves the quality of role mining. Currey et al [15] proposed a multi-objective role mining approach that minimizes unnecessary permissions as the formal goal of role mining. Jafarian et al [16] transformed the role mining problem into a constraint satisfaction problem.…”