A twofold model for the analysis of access control policies in industrial networked systems

The zero trust principle only allows authorized and authenticated actions in a computer network. A network policy satisfies the least privilege principle by minimizing the network permissions to only those needed by users and applications. However, administrators face many challenges in creating a least privilege policy since it requires a detailed understanding of the network topology and knowing the communication requirements of every network application and user. This paper addresses those challenges by introducing a graph-based policy specification framework to capture a network's communication requirements and a network compiler that turns those requirements into an enforceable policy. To offset the effort of building such a stringent policy, we incorporate patterns to spread the work of policy creation over time and people. In the paper, we first elaborate on how our framework's semantics enhances network security and resilience. We then introduce a Security Policy Regression Testing tool (SPRT), which leverages our framework's semantics, to test and reason about consistency, correctness, and relevance of network security policies. Finally, we outline relevant research directions. CCS CONCEPTS• Security and privacy → Access control; Authorization; Network security; Domain-specific security and privacy architectures.

show abstract

“…(5) The tasks or patterns that fail based on the local policy graphs and . (6) The communication requirements that are not meet.…”

Section: Network-aware Policy Verificationmentioning

confidence: 99%

“…Bertolotti et al [6] propose a twofold model for analyzing rolebased access control policies in Industrial Network Systems (INS). They model an INS through two views: the specification view and the implementation view.…”

Section: Industrial Control Systemsmentioning

confidence: 99%

Can I Reach You? Do I Need To? New Semantics in Security Policy Specification and Testing

Katsis

Cicala

Thomsen

et al. 2021

Proceedings of the 26th ACM Symposium on Access Control Models and Technologies

View full text Add to dashboard Cite

show abstract

“…In [12], the authors talk about modeling of distributed systems. In the paper, many mechanisms are cited like the physical containment, the local and remote access rights on system resources.…”

Section: The Elasticity Conceptmentioning

confidence: 99%

Distributed Energy Systems Management Using the Case Based Reasoning

Larbi¹,

Belalem²,

Beldjilali³

2019

IJCA

View full text Add to dashboard Cite

Regarding continued growth in the use of electrical energy, it is important to meet the final customer demand. In a smart grid context, there are several ways to do this. One of means is to add energy storages and infrastructures. We are so interested in this study to the modification of electrical infrastructures. By adapting organizations, managers and their teams must have the adequate behavior and decision making to modify existing materials or add new materials into the existing system. This paper shows a company team's behavior which operates in the field of energy supplying. The purpose of this paper is to show how teams' managers can use a past experience, and to evaluate the impact of structure modification according to decision making using the case based reasoning. The experiments concern more precisely the quantitative aspect of exchanged messages between managers and their teams.

show abstract

Security Perspective Analysis of Industrial Cyber Physical Systems (I-CPS): A Decade-wide Survey

Agrawal¹,

Kumar²

2022

ISA Transactions

View full text Add to dashboard Cite

A twofold model for the analysis of access control policies in industrial networked systems

Cited by 12 publications

References 34 publications

Can I Reach You? Do I Need To? New Semantics in Security Policy Specification and Testing

Can I Reach You? Do I Need To? New Semantics in Security Policy Specification and Testing

Distributed Energy Systems Management Using the Case Based Reasoning

Security Perspective Analysis of Industrial Cyber Physical Systems (I-CPS): A Decade-wide Survey

Contact Info

Product

Resources

About