Evaluating the risk of adopting RBAC roles

Alessandro Colantonio; Roberto Di Pietro; Alberto Ocello; Nino Vincenzo Verde

doi:10.1007/978-3-642-13739-6_21

Evaluating the risk of adopting RBAC roles

Alessandro Colantonio, Roberto Di Pietro, Alberto Ocello, Nino Vincenzo Verde

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

3 Scopus citations

Abstract

We propose a framework to evaluate the risk incurred when managing users and permissions through RBAC. The risk analysis framework does not require roles to be defined, thus making it applicable before the role engineering phase. In particular, the proposed approach highlights users and permissions that markedly deviate from others, and that might consequently be prone to error when roles are operating. By focusing on such users and permissions during the role definition process, it is possible to mitigate the risk of unauthorized accesses and role misuse. © 2010 IFIP International Federation for Information Processing.

Original language	English (US)
Title of host publication	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Pages	303-310
Number of pages	8
DOIs	https://doi.org/10.1007/978-3-642-13739-6_21
State	Published - Oct 29 2010
Externally published	Yes

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-642-13739-6_21

Cite this

@inproceedings{87e8d79d48b246dfbfcfb71a9c93113b,

title = "Evaluating the risk of adopting RBAC roles",

abstract = "We propose a framework to evaluate the risk incurred when managing users and permissions through RBAC. The risk analysis framework does not require roles to be defined, thus making it applicable before the role engineering phase. In particular, the proposed approach highlights users and permissions that markedly deviate from others, and that might consequently be prone to error when roles are operating. By focusing on such users and permissions during the role definition process, it is possible to mitigate the risk of unauthorized accesses and role misuse. {\textcopyright} 2010 IFIP International Federation for Information Processing.",

author = "Alessandro Colantonio and {Di Pietro}, Roberto and Alberto Ocello and Verde, {Nino Vincenzo}",

note = "Generated from Scopus record by KAUST IRTS on 2023-09-20",

year = "2010",

month = oct,

day = "29",

doi = "10.1007/978-3-642-13739-6_21",

language = "English (US)",

isbn = "3642137385",

pages = "303--310",

booktitle = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

}

TY - GEN

T1 - Evaluating the risk of adopting RBAC roles

AU - Colantonio, Alessandro

AU - Di Pietro, Roberto

AU - Ocello, Alberto

AU - Verde, Nino Vincenzo

N1 - Generated from Scopus record by KAUST IRTS on 2023-09-20

PY - 2010/10/29

Y1 - 2010/10/29

N2 - We propose a framework to evaluate the risk incurred when managing users and permissions through RBAC. The risk analysis framework does not require roles to be defined, thus making it applicable before the role engineering phase. In particular, the proposed approach highlights users and permissions that markedly deviate from others, and that might consequently be prone to error when roles are operating. By focusing on such users and permissions during the role definition process, it is possible to mitigate the risk of unauthorized accesses and role misuse. © 2010 IFIP International Federation for Information Processing.

AB - We propose a framework to evaluate the risk incurred when managing users and permissions through RBAC. The risk analysis framework does not require roles to be defined, thus making it applicable before the role engineering phase. In particular, the proposed approach highlights users and permissions that markedly deviate from others, and that might consequently be prone to error when roles are operating. By focusing on such users and permissions during the role definition process, it is possible to mitigate the risk of unauthorized accesses and role misuse. © 2010 IFIP International Federation for Information Processing.

UR - http://link.springer.com/10.1007/978-3-642-13739-6_21

UR - http://www.scopus.com/inward/record.url?scp=77958475384&partnerID=8YFLogxK

U2 - 10.1007/978-3-642-13739-6_21

DO - 10.1007/978-3-642-13739-6_21

M3 - Conference contribution

SN - 3642137385

SP - 303

EP - 310

BT - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

ER -

Evaluating the risk of adopting RBAC roles

Abstract

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this