Adapting usage control as a deterrent to address the inadequacies of access controls

Abstract

a b s t r a c tAccess controls are difficult to implement and evidently deficient under certain conditions. Traditional controls offer no protection for unclassified information, such as a telephone list of employees that is unrestricted, yet available only to members of the company. On the opposing side of the continuum, organizations such as hospitals that manage highly sensitive information require stricter access control measures. Yet, traditional access control may well have inadvertent consequences in such a context. Often, in unpredictable circumstances, users that are denied access could have prevented a calamity had they been allowed access. It has been proposed that controls such as auditing and accountability policies be enforced to deter rather than prevent unauthorized usage. In dynamic environments preconfigured access control policies may change dramatically depending on the context. Moreover, the cost of implementing and maintaining complex preconfigured access control policies sometimes far outweighs the benefits. This paper considers an adaptation of usage control as a proactive means of deterrence control to protect information that cannot be adequately or reasonably protected by access control.

Privacy Requirements: Present & Future

“…Information accountability means the use of information should be transparent so it is possible to determine whether a particular use is appropriate under a given set of rules and that the system enables individuals and institutions to be held accountable for misuse [49]. Some research work is already heading in this direction, for instance, there is a body of work on audit-based solutions for data access in healthcare systems [50], or suggesting means of deterrence for information that requires more than traditional access control enforcement [51], or others offering a posteriori control for systems that require flexibility with accesses that are unanticipated under special circumstances [52]. However, there is a lack of such work in the context of hyper-connected systems like social networks, where the end user is the major active player, i.e.…”

Evaluating Usage Control Deterrents

“…Within this real-world inter-organisational cooperation scenario, it was found that traditional access controls do not comply with the organisation's requirements and that cooperation and competitive reasons motivate the use of interactive and optimistic access controls [12]. Since the flexibility offered by optimistic access control may well be exploited, Padayachee and Eloff [4] proposed that optimistic access control should be complemented with usage control.…”

“…Padayachee and Eloff [4] presented a model for addressing the inadequacies of access controls, which involved a reformulation of usage control as a mechanism to deter users from information abuse, rather than one that is entirely dependent on denial of access. Padayachee and Eloff's [4] approach towards deterrence control is an application of optimistic access control, which is useful in cases where openness and availability are more important than complete confidentiality [5]. Optimistic access control involves a combination of audit and accountability aspects as deterrent mechanisms to encourage trustworthy behaviour.…”