On risk in access control enforcement

Giuseppe Petracca, Frank Capobianco, Christian Skalka, Trent Jaeger

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Citations (Scopus)

Abstract

While we have long had principles describing how access control enforcement should be implemented, such as the reference monitor concept, imprecision in access control mechanisms and access control policies leads to risks that may enable exploitation. In practice, least privilege access control policies often allow information flows that may enable exploits. In addition, the implementation of access control mechanisms often tries to balance security with ease of use implicitly (e.g., with respect to determining where to place authorization hooks) and approaches to tighten access control, such as accounting for program context, are ad hoc. In this paper, we define four types of risks in access control enforcement and explore possible approaches and challenges in tracking those types of risks. In principle, we advocate runtime tracking to produce risk estimates for each of these types of risk. To better understand the potential of risk estimation for authorization, we propose risk estimate functions for each of the four types of risk, finding that benign program deployments accumulate risks in each of the four areas for ten Android programs examined. As a result, we find that tracking of relative risk may be useful for guiding changes to security choices, such as authorized unsafe operations or placement of authorization checks, when risk differs from that expected.

Original languageEnglish (US)
Title of host publicationSACMAT 2017 - Proceedings of the 22nd ACM Symposium on Access Control Models and Technologies
PublisherAssociation for Computing Machinery
Pages31-42
Number of pages12
ISBN (Electronic)9781450347020
DOIs
StatePublished - Jun 7 2017
Event22nd ACM Symposium on Access Control Models and Technologies, SACMAT 2017 - Indianapolis, United States
Duration: Jun 21 2017Jun 23 2017

Publication series

NameProceedings of ACM Symposium on Access Control Models and Technologies, SACMAT
VolumePart F128644

Other

Other22nd ACM Symposium on Access Control Models and Technologies, SACMAT 2017
CountryUnited States
CityIndianapolis
Period6/21/176/23/17

Fingerprint

Access control
Hooks

All Science Journal Classification (ASJC) codes

  • Software
  • Computer Networks and Communications
  • Safety, Risk, Reliability and Quality
  • Information Systems

Cite this

Petracca, G., Capobianco, F., Skalka, C., & Jaeger, T. (2017). On risk in access control enforcement. In SACMAT 2017 - Proceedings of the 22nd ACM Symposium on Access Control Models and Technologies (pp. 31-42). (Proceedings of ACM Symposium on Access Control Models and Technologies, SACMAT; Vol. Part F128644). Association for Computing Machinery. https://doi.org/10.1145/3078861.3078872
Petracca, Giuseppe ; Capobianco, Frank ; Skalka, Christian ; Jaeger, Trent. / On risk in access control enforcement. SACMAT 2017 - Proceedings of the 22nd ACM Symposium on Access Control Models and Technologies. Association for Computing Machinery, 2017. pp. 31-42 (Proceedings of ACM Symposium on Access Control Models and Technologies, SACMAT).
@inproceedings{0dc4b43a74024c0487981d8790ac525e,
title = "On risk in access control enforcement",
abstract = "While we have long had principles describing how access control enforcement should be implemented, such as the reference monitor concept, imprecision in access control mechanisms and access control policies leads to risks that may enable exploitation. In practice, least privilege access control policies often allow information flows that may enable exploits. In addition, the implementation of access control mechanisms often tries to balance security with ease of use implicitly (e.g., with respect to determining where to place authorization hooks) and approaches to tighten access control, such as accounting for program context, are ad hoc. In this paper, we define four types of risks in access control enforcement and explore possible approaches and challenges in tracking those types of risks. In principle, we advocate runtime tracking to produce risk estimates for each of these types of risk. To better understand the potential of risk estimation for authorization, we propose risk estimate functions for each of the four types of risk, finding that benign program deployments accumulate risks in each of the four areas for ten Android programs examined. As a result, we find that tracking of relative risk may be useful for guiding changes to security choices, such as authorized unsafe operations or placement of authorization checks, when risk differs from that expected.",
author = "Giuseppe Petracca and Frank Capobianco and Christian Skalka and Trent Jaeger",
year = "2017",
month = "6",
day = "7",
doi = "10.1145/3078861.3078872",
language = "English (US)",
series = "Proceedings of ACM Symposium on Access Control Models and Technologies, SACMAT",
publisher = "Association for Computing Machinery",
pages = "31--42",
booktitle = "SACMAT 2017 - Proceedings of the 22nd ACM Symposium on Access Control Models and Technologies",

}

Petracca, G, Capobianco, F, Skalka, C & Jaeger, T 2017, On risk in access control enforcement. in SACMAT 2017 - Proceedings of the 22nd ACM Symposium on Access Control Models and Technologies. Proceedings of ACM Symposium on Access Control Models and Technologies, SACMAT, vol. Part F128644, Association for Computing Machinery, pp. 31-42, 22nd ACM Symposium on Access Control Models and Technologies, SACMAT 2017, Indianapolis, United States, 6/21/17. https://doi.org/10.1145/3078861.3078872

On risk in access control enforcement. / Petracca, Giuseppe; Capobianco, Frank; Skalka, Christian; Jaeger, Trent.

SACMAT 2017 - Proceedings of the 22nd ACM Symposium on Access Control Models and Technologies. Association for Computing Machinery, 2017. p. 31-42 (Proceedings of ACM Symposium on Access Control Models and Technologies, SACMAT; Vol. Part F128644).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

TY - GEN

T1 - On risk in access control enforcement

AU - Petracca, Giuseppe

AU - Capobianco, Frank

AU - Skalka, Christian

AU - Jaeger, Trent

PY - 2017/6/7

Y1 - 2017/6/7

N2 - While we have long had principles describing how access control enforcement should be implemented, such as the reference monitor concept, imprecision in access control mechanisms and access control policies leads to risks that may enable exploitation. In practice, least privilege access control policies often allow information flows that may enable exploits. In addition, the implementation of access control mechanisms often tries to balance security with ease of use implicitly (e.g., with respect to determining where to place authorization hooks) and approaches to tighten access control, such as accounting for program context, are ad hoc. In this paper, we define four types of risks in access control enforcement and explore possible approaches and challenges in tracking those types of risks. In principle, we advocate runtime tracking to produce risk estimates for each of these types of risk. To better understand the potential of risk estimation for authorization, we propose risk estimate functions for each of the four types of risk, finding that benign program deployments accumulate risks in each of the four areas for ten Android programs examined. As a result, we find that tracking of relative risk may be useful for guiding changes to security choices, such as authorized unsafe operations or placement of authorization checks, when risk differs from that expected.

AB - While we have long had principles describing how access control enforcement should be implemented, such as the reference monitor concept, imprecision in access control mechanisms and access control policies leads to risks that may enable exploitation. In practice, least privilege access control policies often allow information flows that may enable exploits. In addition, the implementation of access control mechanisms often tries to balance security with ease of use implicitly (e.g., with respect to determining where to place authorization hooks) and approaches to tighten access control, such as accounting for program context, are ad hoc. In this paper, we define four types of risks in access control enforcement and explore possible approaches and challenges in tracking those types of risks. In principle, we advocate runtime tracking to produce risk estimates for each of these types of risk. To better understand the potential of risk estimation for authorization, we propose risk estimate functions for each of the four types of risk, finding that benign program deployments accumulate risks in each of the four areas for ten Android programs examined. As a result, we find that tracking of relative risk may be useful for guiding changes to security choices, such as authorized unsafe operations or placement of authorization checks, when risk differs from that expected.

UR - http://www.scopus.com/inward/record.url?scp=85025477567&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85025477567&partnerID=8YFLogxK

U2 - 10.1145/3078861.3078872

DO - 10.1145/3078861.3078872

M3 - Conference contribution

AN - SCOPUS:85025477567

T3 - Proceedings of ACM Symposium on Access Control Models and Technologies, SACMAT

SP - 31

EP - 42

BT - SACMAT 2017 - Proceedings of the 22nd ACM Symposium on Access Control Models and Technologies

PB - Association for Computing Machinery

ER -

Petracca G, Capobianco F, Skalka C, Jaeger T. On risk in access control enforcement. In SACMAT 2017 - Proceedings of the 22nd ACM Symposium on Access Control Models and Technologies. Association for Computing Machinery. 2017. p. 31-42. (Proceedings of ACM Symposium on Access Control Models and Technologies, SACMAT). https://doi.org/10.1145/3078861.3078872