Attribute Considerations for Access Control Systems

Hu, Vincent C.

doi:10.6028/nist.sp.800-205-draft

Cited by 3 publications

(4 citation statements)

References 6 publications

(7 reference statements)

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…We consider the number of attributes to be finite for the complexity of the algorithm to be bounded. In addition, for different purposes, we may need multiple tables in the database such as one for EDR recording keeping with a limited pool of a week of log record, another for compressed and reduced data set for prolonged storage and future analysis, and one additional table for access control [8], [10], [11] and credentials. Our database system would be having the flexibility to add or remove tables, attributes and perform database normalization [17] as per requirements.…”

Section: Database Architecture For Edr Summarymentioning

confidence: 99%

“…Attributes periodically collected using EDR tools may vary as per their weight in the function of a trust score and its trustworthiness [2], based on which access to a resource is granted. A trust score function can also vary from network to network and can be altered as per requirements as some weak attributes for an enterprise can be strong attributes for another [8].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Application of Data Collected by Endpoint Detection and Response Systems for Implementation of a Network Security System based on Zero Trust Principles and the EigenTrust Algorithm

Kumar¹,

Kasbekar²,

Manjunath³

2022

Preprint

View full text Add to dashboard Cite

Traditionally, security systems for enterprises have implicit access based on strong cryptography, authentication and key sharing, wherein access control is based on Role Based Access Control (RBAC), in which roles such as manager, accountant and so on provide a way of deciding a subject's authority. However, years of post-attack analysis on enterprise networks has shown that a majority of times, security breaches occur intentionally or accidently due to implicitly trusted people of an enterprise itself. Zero Trust Architecture works on the principle of never granting trust implicitly, but rather continuously evaluating the trust parameters for each resource access request and has a strict, but not rigid, set of protocols for access control of a subject to resources. Endpoint Detection and Response (EDR) systems are tools that collect a large number of attributes in and around machines within an enterprise network to have close visibility into sophisticated intrusion. In our work, we seek to deploy EDR systems and build trust algorithms using tactical provenance analysis, threshold cryptography and reputation management to continuously record data, evaluate trust of a subject, and simultaneously analyze them against a database of known threat vectors to provide conditional access control. However, EDR tools generate a high volume of data that leads to false alarms, misdetections and correspondingly a high backlog of tasks that makes it infeasible, which is addressed using tactical provenance analysis and information theory.

show abstract

Section: Database Architecture For Edr Summarymentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Application of Data Collected by Endpoint Detection and Response Systems for Implementation of a Network Security System based on Zero Trust Principles and the EigenTrust Algorithm

Kumar¹,

Kasbekar²,

Manjunath³

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Utilizar uma cache para essas identidades é uma forma de atender esse requisito. Além de que outros benefícios como ter disponível as identidades quando os repositórios originais não podem ser acessados por questões de emergências como baixa largura de banda ou perda de servic ¸o [Hu et al 2019]. A partir da cache de identidades é possível recuperar dados diretamente, sem a necessidade de consultar o diretório de origem do usuário.…”

Section: Cacheunclassified

Uma Política de Cache de Identidades Multinível para Névoas Computacionais

Filho

Cremonezi²,

Silva

et al. 2021

Anais Do XXI Simpósio Brasileiro De Segurança Da Informação E De Sistemas Computacionais (SBSeg 2021)

View full text Add to dashboard Cite

Autenticação e autorização em serviços de redes dependem da identidade e dos atributos relacionados. Entretanto, os ambientes atuais para recuperação dessas informações são geralmente baseados em servidores distantes a alguns saltos do usuário, o que pode prejudicar sua aplicação quando há requisitos temporais. Portanto, o paradigma de névoa computacional deve ser levado em consideração, assim como políticas de recuperação e manutenção em cache de identidades. Este trabalho apresenta uma proposta de política de cache de identidade multinível com prioridade baseada em técnicas de aprendizado de máquina para prever a mobilidade de usuários em redes sem fio. Nossa proposta foi avaliada com dados reais de uma rede sem fio com mais de trinta e seis mil usuários. Os resultados demonstram uma taxa de 64% de acerto para recuperação de identidades na névoa, e ainda reduz em 3,42% o número de saltos para a recuperação de uma identidade, ficando apenas a 6,35% da solução ótima, obtida através da implementação de um oráculo.

show abstract

“…To ensure AC data security, functions to satisfy the following three security requirements may also need to be included [SP205]:…”

Section: Systemsmentioning

confidence: 99%

Blockchain for Access Control Systems

Hu¹

2021

Self Cite

View full text Add to dashboard Cite

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

show abstract

Attribute Considerations for Access Control Systems

Cited by 3 publications

References 6 publications

Application of Data Collected by Endpoint Detection and Response Systems for Implementation of a Network Security System based on Zero Trust Principles and the EigenTrust Algorithm

Application of Data Collected by Endpoint Detection and Response Systems for Implementation of a Network Security System based on Zero Trust Principles and the EigenTrust Algorithm

Uma Política de Cache de Identidades Multinível para Névoas Computacionais

Blockchain for Access Control Systems

Contact Info

Product

Resources

About