Authors:
Leonard Bradatsch
;
Artur Hermann
and
Frank Kargl
Affiliation:
Institute of Distributed Systems, Ulm University, Albert-Einstein-Allee 11, 89081 Ulm, Germany
Keyword(s):
Access Control, Threat Analysis, Risk Assessment, Zero Trust Security.
Abstract:
As enterprises increasingly adopt Zero Trust security, access control based on attributes is regaining attention as a core aspect of Zero Trust. Evaluating the accuracy of access decisions is a vital aspect of securing access control systems, typically involving threat analysis and risk assessment. A notable threat is attackers gaining illegitimate access by compromising the attributes checked by the access control policies. However, a systematic methodology for assessing attribute compromise risk is lacking. Knowing this risk aids in designing more accurate access control policies. This paper introduces a novel framework to address this gap, using modeled attackers and enterprises for risk assessment of attribute compromise. We also present a detailed case study featuring six attackers and two enterprises, demonstrating the framework’s practicality and providing insights into the security strength of fifteen common access control attributes. In the context of the case study, attribu
tes such as Certificate Authentication , along with User Usage and Device Usage, which both reflect the coupling of users and devices, demonstrated high resilience against compromise attempts.
(More)