Evaluating Usage Control Deterrents

Abstract

<jats:p>This paper explores the effectiveness of usage control deterrents. Usage control enables finer-grained control over the usage of objects than do traditional access control models. Deterrent controls are intended to discourage individuals from intentionally violating information security policies or procedures. In this context, an adaptation of usage control is assessed as a proactive means of deterrence control to protect information that cannot be adequately or reasonably protected by access control. These deterrents are evaluated using the design science methodology. Parallel prototypes were developed with the aim of producing multiple alternatives, thereby shifting the focus from purely usability testing to model testing.</jats:p>

An Aspect-Oriented Model to Monitor Misuse

“…Hence the message filtering model developed by Jajodia and Kogan [19] considers only primitive operations such as read and write methods. As the aspect-oriented paradigm facilitates genericity through the use of wildcards, it may extend the message filter model beyond considering only primitive operations [22].…”

“…Further, they do not comment on the propagation of information among objects in a system. To address these shortcomings, we have conducted case-studies to demonstrate that the aspectoriented methodology might be useful for detecting illegal flows between objects [22].…”

“…The model however, has limitations as it only identifies explicit flows [35]. We have also demonstrated via a case study that using aspect-oriented flow model may useful in identifying programming attacks [22]. In this paper we reprised this model in a more generalized context such that it may be useful be in identifying programming attacks.…”