institute for cyber security a framework for risk aware
play

Institute for Cyber Security A Framework for Risk-Aware Role Based - PowerPoint PPT Presentation

Dec 15, 2022 •47 likes •227 views

Institute for Cyber Security A Framework for Risk-Aware Role Based Access Control Khalid Zaman Bijon, Ram Krishnan and Ravi Sandhu Institute for Cyber Security University of Texas at San Antonio October 16, 2013 SafeConfig 2013: IEEE 6th

  1. Institute for Cyber Security A Framework for Risk-Aware Role Based Access Control Khalid Zaman Bijon, Ram Krishnan and Ravi Sandhu Institute for Cyber Security University of Texas at San Antonio October 16, 2013 SafeConfig 2013: IEEE 6th Symposium on Security Analytics and Automation 1 1 World-Leading Research with Real-World Impact!

  2. Traditional Organizations Access Control Mechanism 2 World-Leading Research with Real-World Impact!

  3. General Access Control Systems S 1 Reference Monitor ……… S n Mediates all access User Subject/ Object requests Session Implemented Process (e.g., Alice, Resources to Access Control pid ), session Bob, etc. protect, e.g., models, e.g., (e.g., s ip ), mp3, doc, txt, RBAC, DAC, etc. directory. MAC. 3 World-Leading Research with Real-World Impact!

  4. Modern Organizations ACM 4 World-Leading Research with Real-World Impact!

  5. Intro. & Motivation Possible Solutions?  Authenticate and grant same access everywhere  Is not sufficient  How do we know that the person in the other side is true employee  Secure every place/situation by antivirus/firewalls  Not scalable/feasible  Impractical  More dynamism in access control systems  Accept/Deny accesses based on security threats/risks involve in every situations/places instead of always giving same outcome for a user 5 World-Leading Research with Real-World Impact!

  6. Intro. & Motivation Overall Strategy  Risk-Awareness in Access Control Systems  Quantified Approach (Risk is represented as a metric)  Calculate risk value, involved in every situation  Grant access accordingly based on the estimated risk value 6 World-Leading Research with Real-World Impact!

  7. Intro. & Motivation (cont.) Conducted Research in this Arena  MITRE Corporation Jason Program Office. Horizontal integration: Broader access models for realizing information dominance (2004)  Pioneer work in quantified risk-aware access control systems  Risk-awareness in Access Control Systems:  E. Celikel et al (2009), F.Salim et al (2011), L. Chen et al (2011), N. Baracaldo et al (2012), K. Bijon et al (2012), S. Chari et al (2012) and others: Risk-awareness in Role Based Access Control (RBAC) system (mainly focused on developing technique on risk- estimation and utilization)  P. Cheng (2007), Q Ni (2010): Risk-awareness in Lattice Based Access Control (LBAC)  R. McGraw (2009), Kandala et al(2011): Identify risk-factors for a risk-aware access control system  H. Khambhammettu et al (2013): a framework for various risk-assessment approaches in access control 7 World-Leading Research with Real-World Impact!

  8. A Framework for Risk-Aware RBAC  The Framework  Identify the Risk-Aware RBAC Components  Faces different types of security risk while performing their operations  Need to develop additional functionalities to support a risk-awareness  Different Types of Risk-Awareness  Traditional Approaches  Quantified Approaches  Non-adaptive approach  Adaptive approach 8 World-Leading Research with Real-World Impact!

  9. Risk-Aware RBAC Components Permission- User-Role Role Assignment Assignment (URA) (PRA) Constraints 9 World-Leading Research with Real-World Impact!

  10. Risk-Awareness Types  Traditional Approaches  Constraints driven risk mitigation  No explicit notion of risk value  Quantified Approaches  Risk is explicitly represented as a metric  Risk is mitigated based on the estimated value 10 World-Leading Research with Real-World Impact!

  11. Traditional Risk-Awareness RH 1. Administrative user needs to identify risky operations and generate constraints accordingly. (For example, a constraints can restrict two risky roles from assigning to same user (SSOD). 2. Static in nature (a constraint always 1. Static Separation of Duty (SSOD) gives same outcome, unless 2. Dynamic Separation of Duty (DSOD) modified) 11 World-Leading Research with Real-World Impact!

  12. Quantified Risk-Awareness (Non-Adaptive) 1. Risk-threshold should vary across sessions (e.g. a session from office vs. session from home pc) 2. Risk-threshold limits user activities by restricting role- activation 12 World-Leading Research with Real-World Impact!

  13. Quantified Risk-Awareness (Adaptive) 1. Continuous user-activities monitoring and anomaly detection 2. Response mechanism by automatic revocation of privileges (e.g. system automated role deactivation) 13 World-Leading Research with Real-World Impact!

  14. Formal Specification Formally enhance NIST Core RBAC model  − To support a session with adaptive risk-threshold Functions of the adaptive quantified risk-aware sessions  − AssignRisk : assigns a risk value to a permission − RoleRisk : returns estimated risk of a role − CreateSession : user creates a session and system calculate risk-threshold for the session − AddActiveRole : called by users, tries to activate a particular − Deactivation : called by AddActiveRole to deactivate some already activated roles in order to activate that role − SActivityMonitor : This function monitors user sessions, if something is wrong it calls system automated deactivation (SADeactivation) function. − SADeactivation : This function automatically identifies which roles need to deactivate and asks user to deactivate them. 14 World-Leading Research with Real-World Impact!

  15. Conclusion  To Summarize the framework:  The Risk-Aware RBAC Components are identified  Sessions, User-Role assignments, Permission-Role assignments, Role Hierarchy, Constraints  Each components should have different functionalities (need to be developed to support a Risk-Awareness)  Different Types of Risk-Awareness Approaches  Traditional Approaches  Constraints specific (implicit risk and static in nature)  Quantified Approaches  Non-adaptive approach (explicit notion of risk that varies across different situations)  Adaptive approach ( need run-time monitoring capabilities and additional system functions for automatic response) 15 World-Leading Research with Real-World Impact!

  16. Future Work Permission- User-Role Role Assignment Assignment (URA) (PRA) Constraints 16 World-Leading Research with Real-World Impact!

  17. The End Questions? 17 World-Leading Research with Real-World Impact!

  18. Backup http://www.forbes.com/sites/danschawbel/2013/03/29/da vid-heinemeier-hansson-every-employee-should-work- from-home/

Recommend

Cyber Security Risk Using the Cyber Security Measurement Framework Cyber Security Framework

Cyber Security Risk Using the Cyber Security Measurement Framework Cyber Security Framework

Cyber Security Risk Using the Cyber Security Measurement Framework Cyber Security Framework Reporting Objectives Executive Summary Information Assess Current Cyber Security Posture Measure Progress Toward Improvement Assess

634 views • 5 slides
Institute for Cyber Security Towards Provenance and Risk-Awareness in Social Computing Yuan

Institute for Cyber Security Towards Provenance and Risk-Awareness in Social Computing Yuan

Institute for Cyber Security Towards Provenance and Risk-Awareness in Social Computing Yuan Cheng, Dang Nguyen, Khalid Bijon, Ram Krishnan, Jaehong Park and Ravi Sandhu Institute for Cyber Security University of Texas at San Antonio September

256 views • 12 slides
System Aware Cyber Security Barry M. Horowitz, PI University of Virginia November, 2012 System

System Aware Cyber Security Barry M. Horowitz, PI University of Virginia November, 2012 System

System Aware Cyber Security Barry M. Horowitz, PI University of Virginia November, 2012 System Aware Cyber Security Operates at the system application-layer , For security inside of the network and perimeter protection provided for the

164 views • 3 slides
2017 CTMA INTEGRATED PROJECT BRIEF: GLIS/CYBER SECURITY RISK MANAGEMENT FRAMEWORK Background:

2017 CTMA INTEGRATED PROJECT BRIEF: GLIS/CYBER SECURITY RISK MANAGEMENT FRAMEWORK Background:

2017 CTMA INTEGRATED PROJECT BRIEF: GLIS/CYBER SECURITY RISK MANAGEMENT FRAMEWORK Background: Modernizing USMC LOG IT Original ERP Path had 9 Increments Everything to be in the Oracle E-Business Suite Under the ACAT IAM program

332 views • 15 slides
CYBER SECURITY Nick Kervin Partner, IT Advisory August 2017 Page 1 CYBER SECURITY Overview

CYBER SECURITY Nick Kervin Partner, IT Advisory August 2017 Page 1 CYBER SECURITY Overview

CYBER SECURITY Nick Kervin Partner, IT Advisory August 2017 Page 1 CYBER SECURITY Overview 1. What is at risk? 2. Global industry trends 3. BDO/AusCERT survey 4. Recent cyber case studies 5. Cyber risk mitigation strategies Page

481 views • 35 slides
System Aware Cyber Security Application of Dynamic System Models and State Estimation Technology

System Aware Cyber Security Application of Dynamic System Models and State Estimation Technology

System Aware Cyber Security Application of Dynamic System Models and State Estimation Technology to the Cyber Security of Physical Systems Barry M. Horowitz, Kate Pierce University of Virginia April, 2012 This material is based upon work

518 views • 41 slides
Synergy: Collaborative: Security and Privacy-Aware Cyber-Physical Systems (NSF CNS-1505799 and

Synergy: Collaborative: Security and Privacy-Aware Cyber-Physical Systems (NSF CNS-1505799 and

Synergy: Collaborative: Security and Privacy-Aware Cyber-Physical Systems (NSF CNS-1505799 and the Intel-NSF Partnership for Cyber- Physical Systems Security and Privacy) Insup Lee (PI) PRECISE Center School of Engineering and Applied Science

1.11k views • 34 slides
Advanced Cyber Risk Management Threat Modeling & Cyber Wargaming April 23, 2018 The

Advanced Cyber Risk Management Threat Modeling & Cyber Wargaming April 23, 2018 The

Advanced Cyber Risk Management Threat Modeling & Cyber Wargaming April 23, 2018 The Homeland Security Systems Engineering and Development Institute (HSSEDI) is a trademark of the U.S. Department of Homeland Security (DHS). The HSSEDI

149 views • 13 slides
90% OF CYBER ATTACKS ARE 90% OF CYBER ATTACKS ARE SUCCESSFUL DUE TO HUMAN SUCCESSFUL DUE TO

90% OF CYBER ATTACKS ARE 90% OF CYBER ATTACKS ARE SUCCESSFUL DUE TO HUMAN SUCCESSFUL DUE TO

90% OF CYBER ATTACKS ARE 90% OF CYBER ATTACKS ARE SUCCESSFUL DUE TO HUMAN SUCCESSFUL DUE TO HUMAN ERROR ERROR CYBER AWARE CYBER AWARE NEXT-GEN SECURITY AWARENESS TRAINING Cyber Crime Is Now A Cyber Crime Is Now A Business Opportunity

550 views • 25 slides
Institute for Cyber Security A Lattice Interpretation of Group-Centric Collaboration with

Institute for Cyber Security A Lattice Interpretation of Group-Centric Collaboration with

Institute for Cyber Security A Lattice Interpretation of Group-Centric Collaboration with Expedient Insiders Khalid Zaman Bijon, Tahmina Ahmed, Ravi Sandhu, Ram Krishnan Institute for Cyber Security University of Texas at San Antonio 1 1

336 views • 16 slides
Institute for Cyber Security A Formal Model for Isolation Management in Cloud

Institute for Cyber Security A Formal Model for Isolation Management in Cloud

Institute for Cyber Security A Formal Model for Isolation Management in Cloud Infrastructure-as-a-Service Khalid Zaman Bijon, Ram Krishnan and Ravi Sandhu Institute for Cyber Security University of Texas at San Antonio October 15-17, 2014 NSS

146 views • 13 slides
Security and Privacy-Aware Cyber-Physical Systems: Legal Considerations Christopher S. Yoo

Security and Privacy-Aware Cyber-Physical Systems: Legal Considerations Christopher S. Yoo

Security and Privacy-Aware Cyber-Physical Systems: Legal Considerations Christopher S. Yoo University of Pennsylvania July 12, 2018 Overview of Research Tort and products liability for CPS Privacy and cybersecurity regulation NHTSA

472 views • 25 slides
Demystifying Cyber Insurance European Legal Security Forum 2016 12 th July 2016 Agenda The

Demystifying Cyber Insurance European Legal Security Forum 2016 12 th July 2016 Agenda The

Demystifying Cyber Insurance European Legal Security Forum 2016 12 th July 2016 Agenda The Evolution of Cyber Insurance Is Cyber Risk Already Insured? Cyber And Data Protection Is Not Just An IT Issue Case Study Cyber Risk Stakeholders The

1.03k views • 8 slides
Data Driven Assessment of Cyber Risk: Challenges in Assessing and Mitigating Cyber Risk

Data Driven Assessment of Cyber Risk: Challenges in Assessing and Mitigating Cyber Risk

Data Driven Assessment of Cyber Risk: Challenges in Assessing and Mitigating Cyber Risk Challenges in Assessing and Mitigating Cyber Risk Mustaque Ahamad, Saby Mitra and Paul Royal Georgia Tech Information Security Center Georgia Tech

763 views • 16 slides
Institute for Cyber Security Towards An Attribute Based Constraints Specification Language

Institute for Cyber Security Towards An Attribute Based Constraints Specification Language

Institute for Cyber Security Towards An Attribute Based Constraints Specification Language Khalid Zaman Bijon, Ram Krishnan and Ravi Sandhu Institute for Cyber Security University of Texas at San Antonio September 11, 2013 2013 ASE/IEEE

425 views • 17 slides
Designing, Building and Managing a Cyber Security Program Based on the NIST Cybersecurity

Designing, Building and Managing a Cyber Security Program Based on the NIST Cybersecurity

Designing, Building and Managing a Cyber Security Program Based on the NIST Cybersecurity Framework (NIST CSF) A Business Case Agenda and Objectives The Digital Innovation Economy The Cyber Security Problem The Cyber Security Solution

260 views • 22 slides
Institute for Cyber Security The University of Texas at San Antonio World-Leading Research with

Institute for Cyber Security The University of Texas at San Antonio World-Leading Research with

Institute for Cyber Security The University of Texas at San Antonio World-Leading Research with Real-World Impact! April 20, 2010 To: Julian Thrash From: Jeff Reich, Director of Operations for the Institute for Cyber Security Subject:

176 views • 3 slides
Risk-Aware Role-Based Access Control Liang Chen Jason Crampton Information Security Group, Royal

Risk-Aware Role-Based Access Control Liang Chen Jason Crampton Information Security Group, Royal

Risk-Aware Role-Based Access Control Liang Chen Jason Crampton Information Security Group, Royal Holloway, University of London 7th International Workshop on Security and Trust Management Risk-Aware RBAC Introduction Introduction

604 views • 16 slides
Nationwide Cyber Situational Awareness Framework for Critical In Infrastructures Hayretdin

Nationwide Cyber Situational Awareness Framework for Critical In Infrastructures Hayretdin

A A Conceptual Nationwide Cyber Situational Awareness Framework for Critical In Infrastructures Hayretdin Bahi , Olaf Manuel Maennel Centre For Digital Forensics and Cyber Security Tallinn University of Technology Evolvement of Cyber

470 views • 13 slides
Cyber Security in Mining Automation Ragnar Schierholz, Head of Cyber Security, Industrial

Cyber Security in Mining Automation Ragnar Schierholz, Head of Cyber Security, Industrial

ABB MINING USER CONFERENCE, MAY 02-05, 2017 Cyber Security in Mining Automation Ragnar Schierholz, Head of Cyber Security, Industrial Automation Division Agenda Why worry about cyber security? ABBs approach to cyber security Cyber security

1.07k views • 39 slides
Degrees of Risk Defining a Risk Management Framework for Climate Security Nick Mabey, E3G

Degrees of Risk Defining a Risk Management Framework for Climate Security Nick Mabey, E3G

Degrees of Risk Defining a Risk Management Framework for Climate Security Nick Mabey, E3G February 2011 Background to the Report Builds on E3Gs climate security work since 2005 Seminars with climate and security experts in 2009-10

811 views • 51 slides
Planes, Trains and Automobiles (and Ships & Spacecraft) Mobility Cyber Security Andy Davis,

Planes, Trains and Automobiles (and Ships & Spacecraft) Mobility Cyber Security Andy Davis,

Planes, Trains and Automobiles (and Ships & Spacecraft) Mobility Cyber Security Andy Davis, Transport Assurance Practice Director Global experts in cyber security & risk mitigation Agenda Size of the challenge Levels of cyber

824 views • 14 slides
Cyber Security Awareness Seminar Presented By: Ryan Moore Ohio Cyber Range Institute, University

Cyber Security Awareness Seminar Presented By: Ryan Moore Ohio Cyber Range Institute, University

Cyber Security Awareness Seminar Presented By: Ryan Moore Ohio Cyber Range Institute, University of Cincinnati About This Seminar Designed for everyday cyber citizens Online Webinar 2 hour Presentation 10 Minute break

607 views • 57 slides
Cyber Insurance: Protect Your Wine Business Against Data Security Breaches and Other Cyber Risks

Cyber Insurance: Protect Your Wine Business Against Data Security Breaches and Other Cyber Risks

AUGUST 25, 2015 Cyber Insurance: Protect Your Wine Business Against Data Security Breaches and Other Cyber Risks Tyler Gerking, Partner David B. Smith, CPCU, ARM, Insurance & Risk Management Consultant What is Cyber Insurance?

368 views • 10 slides

More recommend