1 / 9

ASCAA Principles for Next-Generation Role-Based Access Control

ASCAA Principles for Next-Generation Role-Based Access Control. Ravi Sandhu Executive Director & Endowed Professor Institute for Cyber Security Univ. of Texas at San Antonio ravi.sandhu@utsa.edu www.profsandhu.com. The State of Cyber Security.

kort
Download Presentation

ASCAA Principles for Next-Generation Role-Based Access Control

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. ASCAA Principles for Next-Generation Role-Based Access Control Ravi Sandhu Executive Director & Endowed Professor Institute for Cyber Security Univ. of Texas at San Antonio ravi.sandhu@utsa.edu www.profsandhu.com

  2. The State of Cyber Security • We are in the midst of big change in cyber space • Nobody knows where we are headed • So far we have done a pretty bad job in cyber security • There is hope • New services will not be held back • Need for security will remain • “Good enough” security is feasible

  3. Security Schools of Thought • OLD THINK: We had it figuredout. If the industry had only listened to us our computers and networks today would be secure. We can do security without considering applications • REALITY: Today’s and tomorrow’s cyber systems and their security needs are fundamentally different from the timesharing era of the early 1970’s. Security without application context is an oxymoron.

  4. Fundamental Security Challenges • Balance security, convenience and cost • Make security seamless but not too seamless for the user • Make security flexible but not too flexible for the administrators • Make security models conform to business and social models NOT vice versa

  5. RBAC: Role-Based Access Control • Access is determined by roles • A user’s roles are assigned by security administrators • A role’s permissions are assigned by security administrators

  6. ... RBAC96 Model ROLE HIERARCHIES USER-ROLE ASSIGNMENT PERMISSIONS-ROLE ASSIGNMENT ROLES PERMISSIONS USERS SESSIONS CONSTRAINTS

  7. Founding Principles of RBAC96 • Abstraction of Privileges • Credit is different from Debit even though both require read and write • Separation of Administrative Functions • Separation of user-role assignment from role-permission assignment • Least Privilege • Right-size the roles • Don’t activate all roles all the time • Separation of Duty • Static separation: purchasing manager versus accounts payable manager • Dynamic separation: cash-register clerk versus cash-register manager

  8. ASCAA Principles for Future RBAC • Abstraction of Privileges • Credit vs debit • Personalized permissions • Separation of Administrative Functions • Containment • Least Privilege • Separation of Duties • Usage Limits • Human in the loop • Automation • Revocation • Assignment: (i) Self-assignment, (ii) Attribute-based • Context and environment adjustment • Accountability • Re-authentication/Escalated authentication • Click-through obligations • Notification and alerts

  9. Conclusion • RBAC is here to stay • But needs continuous improvement • Access control needs agility • Usage limits • Automation (self-administration) • Accountability • This is already happening • Our models have fallen behind

More Related