The table uses comparative terminology such as High, Medium and Low and, descriptive terminology such as Active, Passive, and Simple, and the standard Yes (Y) and No (N). The research provides the solutions based in the problems identified with the access controls evaluated.
Table I: Evaluation of Access Control
Criteria
TMAC
SAC
Matrix
TBAC
C-TMAC
RBAC
Context-AW
Complexity
Medium
Low
Low
Medium
Medium
Medium
High
Understandability
Simple
Simple
Simple
Simple
Simple
Simple
Simple
Ease Use
High
Low
Medium
Medium
High
High
High
Applicability
Medium
Low
Medium
Medium
High
High
High
Groups of users / Collaboration Support.
Y
Y
Low
Y
Y
Y
Y
Policy- Speci-cation
Y
Y
Low
Low
Y
Y
Y
Policy -Enforcement
Y
Low
Low
Low
Y
Y
Y
Fine-grained control
Y
N
N
Low
Y
Low
Y
Active and passive
Active
Active
Passive
Active
Active
Passive
Active
Contextual information
Medium
Medium
N
Medium
Medium
Low
Medium
Solutions to Access Control Problems
To address the access control security problems, Gauthier, and Merlo, (2012) suggests ACMA (Access Control Model Analyzer) tool, which is an effective information security tool to repair and detect the access control vulnerabilities. The ACMA is anchored on the model checking theory and inter-procedural analysis, which has been proved fast, scalable and precise. The ACMA serves as a model-checking tool to detect access control vulnerabilities, which include forced browsing and faulty access control. The ACMA could achieve comparable result because the tools are 890 times faster. Typically, ACMA could be used to implement access control check on the hidden execution paths in the web application. (Gauthier, and Merlo, 2012). Despite the elegant benefits of ACMA in addressing the access control problems, the system may not deter sophisticated hackers from perpetuating their illegal acts. Sophisticated hackers are no more relying on manual methods of getting access into the information assets; sophisticated hackers now use automated tools to lay their hands onto the company's valuable and sensitive data.
On the other hand, Bullock and Benford (1999) argue that access control model is an effective security tool to manage collaborative environment. The authors recommend effective access control requirements, which include:
Access control must be used to enforce and apply the distributed platform level.
Access control model should be configured to meet the needs of wide varieties enterprises model. Such models must provide the efficient access rights.
Access control should enhance greater scalability than the traditional single user model.
Access control models should be able to protect the greater number of information resources within a shared environment.
Access control model must facilitate transparent access from authorized users and a strong exclusion of unauthorized users.
However, the solutions presented by the authors are purely technical in nature; such perspectives neglect the practice of effective control mechanisms.
This paper proposes a model called Computer-Information Systems Supported Access Control (CSSAC) that does not follow yes or no paradigm commonly used in practice. The CSSAC is structured on the combination of human and technical protection tools, which include:
Awareness
Protection
Negotiation.
Traceability
Restorability
Protection is a pattern where organizations safeguard the information resources using regulating access in order to determine the legitimacy of other actors. This technique is an access control tool to protect unauthorized access to information resources. Legitimacy to access control could be controlled using technical methodology. In this system, two different control systems will be used for access control and one for protection while other will be used to grant access.
Negotiability is the technique where the systems are aware of the intended access and develop a channel of communication to control who want to get access.
Traceability is built into the systems to evaluate the illegitimate access to information resources and the systems have ability to alert information system manager that illegal access control is about to happen. Technically, traceability is used as an alert protocol to safeguard the information resources from penetrators before it actually happen.
Restorability is the ability to undo the illegitimate access. The application of this security mechanisms assists in supporting ex-post protection.
Discussability in combination of traceability, which integrates communication channel into the information systems to guide against access to information resources not technically, implemented.
Conclusion
Access control is technically security mechanisms built on authentication. While organizations rely on digital information to make effective decision-making, many organizations still face challenges to protect their information assets from external intruders. Technically, access controls are continuingly being used to safeguard the information assets, despite the benefits derived from access controls, access controls vulnerabilities are still on the increase. This paper explores various types of access controls and their shortcomings. All the access controls indentified have their shortcomings and through these shortcomings, penetrators could often get access to organizational information resources. To address the access control problems, the research suggests Computer-Information Systems Supported Access Control (CSSAC) model to alleviate the common problems identified within the traditional access control systems. This study will address the common challenges that organizations, government and individuals often face in protection of their information resources.
References
Ahn, G.J. & Sandhu, R. (2000). Role-based authorization constraints speci-cation. ACM Trans.
Inf. Syst. Secur. 3(4).
Bullock, a. And Benford, S. (1999). Framework of the Access control for multi-user collaborative environments. In ACM Group. Phoenix, AZ.
Gauthier, F. & Merlo, E.(2012). Fast Detection of Access Control Vulnerabilities in PHP Applications. 2012 19th Working Conference on Reverse Engineering.
Kang, M.H., Park, J.S. And Froscher, J.N. (2001). Access control mechanisms for inter-organizational work-ow. In ACM Symposium on Access Control Model and Technology.
Chantilly, VA.
Layton, T.P. (2007). Information Security: Design, Implementation, Measurement, and Compliance. Boca Raton, FL: Auerbach publications. ISBN 978-0-8493-7087-8.
Lee, M. Deok, N. Lee, K. et al. (2011). Design and Implementation of am Intranet Security and Access Control Systems in UBI-COM. Computing & Informatics.
Li, N. & Tripunitara, M.V. (2006).Security analysis in role-based access control. ACM Transactions on Information and System Security (TISSEC). 9 (4): 391-420.
Stevens, G. & Wuff, V.(2009). Computer-supported access control. ACM Transactions on Computer-Human Interaction (TOCHI). 16 (3):12-26.
Stevens, G., Quaisser, G. Klann, M.(2006). Breaking it up: An industrial case study of componend-based tailorable software design. In End User Development, H. Liebermann et al.,
Eds. Springer, 269 -- 294.
Tolone, W. Ahn, G. Pai, T.et al.(2005). Access control in collaborative systems. ACM Computing Surveys (CSUR). 37(1): 29-41.
Controls Reduce Security Threats Technology is only a part of the measures it takes to produce a strong, secure information system. Well written security policies can lay the ground work and tell employees what is mandated and required to protect the information system. Remote access should be a part of the security policy to control who does what and what they are allowed to access in the system. Setting standards for
SECURITY Information Security and Risk Management in IT This essay is designed to present and discuss both an assessment of information security and risk management in IT systems and a comparative discussion of important academic theories related to security and risk. In the first section, An assessment, a conceptual framework will emerge including reference to important terminology and concepts as well as an outline of legislation and authorized usage examples. In the
Access controls are widely used today. Can you discuss some controls that have had a great degree of success? Which ones if any are not very useful and why? Although access controls on television, such as the V-chip, have met with mixed responses, on the Internet, richer labeling selection systems such as PICS, or Platform for Internet Content Selection, have "been able to establish Internet conventions for label formats and distribution
Security Information security is a primary concern for consumers and businesses. In "IT security fails to keep pace with the rise of cloud computing," the author claims that in spite of the advancements in cloud technology, information security has not kept pace. This assessment is rooted firmly in fact and best practices in the information security industry. Although their analysis is thorough, the authors would do well to point out the
These certificates are issued by the certification authorities (CAs) and they contain the name, expiration dates as well as serial numbers of the certificates. OS Hardening Operating system hardening is the process of addressing the various security issues and vulnerabilities in a given operating system via the implementation of the latest Operating system patches, updates, hotfixes as well procedures and policies that are necessary for reducing the number of attacks as well
Security at Work Information Security within the nursing fraternity With the advent of consolidated information storage within the nursing fraternity, there has grown the need to have better security and controlled access to such information that may be considered confidential and for the use by the nurse and the patient alone. When anyone wants therefore to have access to the documents I will always need to verify several details just to be
Our semester plans gives you unlimited, unrestricted access to our entire library of resources —writing tools, guides, example essays, tutorials, class notes, and more.
Get Started Now