Visible to the public RiskPol : A Risk Assessment Framework for Preventing Attribute-Forgery Attacks to ABAC Policies

TitleRiskPol : A Risk Assessment Framework for Preventing Attribute-Forgery Attacks to ABAC Policies
Publication TypeConference Paper
Year of Publication2018
AuthorsRubio-Medrano, Carlos E., Zhao, Ziming, Ahn, Gail-Joon
Conference NameProceedings of the Third ACM Workshop on Attribute-Based Access Control
Conference LocationNew York, NY, USA
ISBN Number978-1-4503-5633-6
Keywordsattribute based access control, attribute forgery, attribution, composability, Human Behavior, human-in-the-loop security center paradigm, Metrics, policy bypassing, pubcrawl, risk management, zero trust

Recently, attribute-based access control (ABAC) has emerged as a convenient paradigm for specifying, enforcing and maintaining rich and flexible authorization policies, leveraging attributes originated from multiple sources, e.g., operative systems, software modules, remote services, etc. However, attackers may try to bypass ABAC policies by compromising such sources to forge the attributes they provide, e.g., by deliberately manipulating the data contained within those attributes at will, in an effort to gain unintended access to sensitive resources as a result. In such a context, performing a proper risk assessment of ABAC policies, taking into account their enlisted attributes as well as their corresponding sources, becomes highly convenient to overcome zero-day security incidents or vulnerabilities, before they can be later exploited by attackers. With this in mind, we introduce RiskPol, an automated risk assessment framework for ABAC policies based on dynamically combining previously-assigned trust scores for each attribute source, such that overall scores at the policy level can be later obtained and used as a reference for performing a risk assessment on each policy. In this paper, we detail the general intuition behind our approach, its current status, as well as our plans for future work.

Citation Keyrubio-medrano_riskpol_2018