Mutation Testing of Access Control Policies

Abstract

One of the most important and integral components of modern computer security are access control systems. The objective of an access control system (ACS) is often described in terms of protecting system resources against inappropriate or unwanted user access. However, a large degree of sharing can interfere with the protection of resources, so a sufficiently detailed AC policy should allow selective exchange of information when, in its absence, sharing can be considered too risky in general. Erroneous configurations, faulty policies, as well as flaws in the implementation of software can lead to global insecurity. Identifying the differences between policy specifications and their intended functions is crucial because the correct implementation and enforcement of the policies of a particular application is based on the premise that the specifications of this policy are correct. As a result of the policy, the specifications presented by the models must undergo rigorous validation and legalization through systematic checks and tests to ensure that the specifications of the policies really correspond to the wishes of the creators. Verifying that access control policies and models are consistent is not a trivial and critical task. And one of the important aspects of such a check is a formal check for inconsistency and incompleteness of the model, and the security requirements of the policy, because the access control model and its implementation do not necessarily express policies that can also be hidden, embedded by mixing with direct access restrictions or another access control model.

Devising a procedure to determine the level of informational space security in social networks considering interrelations among users

“…Article [11] shows that as a result of the policy of access, specifications, the presented models must undergo rigorous verification and legalization through systematic inspections and tests to make sure that the policy specifications do meet the wishes of developers. The verification of the policy of access control and agreement of models is not a trivial and crucial task, but one of the important aspects of such verification is a formal check if the model is inconsistent and incomplete or if it meets well the requirement of security policy.…”

“…Scientists explored networks in terms of their physical nature and possible impact on the protection of information [8][9][10], access to information policy [11][12][13], protection of personal information from the point of view of law [14], protection against outside electromagnetic radiation [15].…”

Засоби Кіберзахисту На Рівні Мережної Інфраструктури

“…Організаційно-технічні побудови систем кібербезпеки різних країн розглядались в національних стратегіях кібербезпеки, рекомендаціях ENISA, ITU, NATО. Робіт і досліджень доволі багато [1][2][3][4][5][6][7][8][9][10][11][12][13][14], але на даний час в Україні недостатньо досліджень саме з питань розбудови ОТМ кіберзахисту (ОТМК) та з розвитку національної системи кібербезпеки в цілому. Отже головною задачею в сфері комунікаційних мереж і спеціального зв'язку стає розробка концептуальних засад формування та впровадження ОТМ кіберзахисту України.…”