TY - GEN
T1 - Management of exceptions on access control policies
AU - Alfaro, Joaquin Garcia
AU - Cuppens, Frederic
AU - Cuppens-Boulahia, Nora
PY - 2007/11/26
Y1 - 2007/11/26
N2 - The use of languages based on positive or negative expressiveness is very common for the deployment of security policies (i.e., deployment of permissions and prohibitions on firewalls through singlehanded positive or negative condition attributes). Although these languages may allow us to specify any policy, the single use of positive or negative statements alone leads to complex configurations when excluding some specific cases of general rules that should always apply. In this paper we survey such a management and study existing solutions, such as ordering of rules and segmentation of condition attributes, in order to settle this lack of expressiveness. We then point out to the necessity of full expressiveness for combining both negative and positive conditions on firewall languages in order to improve this management of exceptions on access control policies. This strategy offers us a more efficient deployment of policies, even using fewer rules.
AB - The use of languages based on positive or negative expressiveness is very common for the deployment of security policies (i.e., deployment of permissions and prohibitions on firewalls through singlehanded positive or negative condition attributes). Although these languages may allow us to specify any policy, the single use of positive or negative statements alone leads to complex configurations when excluding some specific cases of general rules that should always apply. In this paper we survey such a management and study existing solutions, such as ordering of rules and segmentation of condition attributes, in order to settle this lack of expressiveness. We then point out to the necessity of full expressiveness for combining both negative and positive conditions on firewall languages in order to improve this management of exceptions on access control policies. This strategy offers us a more efficient deployment of policies, even using fewer rules.
UR - https://www.scopus.com/pages/publications/36248989621
U2 - 10.1007/978-0-387-72367-9_9
DO - 10.1007/978-0-387-72367-9_9
M3 - Conference contribution
AN - SCOPUS:36248989621
SN - 0387723668
SN - 9780387723662
T3 - IFIP International Federation for Information Processing
SP - 97
EP - 108
BT - New Approaches for Security, Privacy and Trust in Complex Environments
A2 - Venter, Hein
A2 - Eloff, Jan
A2 - Eloff, Mariki
A2 - Labuschagne, Les
A2 - Solms, Rossouw
ER -