![](bg8.png)
7 CONCLUSION
Updating security policies is a crucial task for any
organization. In this study, we present and describe
a framework that aims at supporting security poli-
cymakers within the Cloud infrastructure by provid-
ing possible actions to be taken for improving cur-
rent IAM using collaborative knowledge in cyberse-
curity. The proposed framework uses collaborative
and anonymized CTI shared through the threat intel-
ligence sharing platform and preprocesses CTI with
the proposed tool that exploits NLP approach. We
described a correlation between elements of attribute-
based access control policies and security reports us-
ing the most comprehensive ontology in cybersecu-
rity. We present and describe the policy update pro-
cess that modifies policy elements using IoC reported
in security reports.
In future work, we plan to extend our approach to
handle more complex attribute-based access control
policies used in specific environments e.g., industrial
sector, and enforce countermeasures specified in CTI.
Moreover, we consider extending our framework with
additional components for evaluating the effect of the
updated policies on the overall system’s security, and
thus, test the efficiency of new policies. Hence, the
future version approach will allow authorized users to
access digital resources while preserving any access
from entities defined in CTI reports.
ACKNOWLEDGMENT
This paper was partially supported by the EU H2020
funded project SPARTA, ga n. 830892.
REFERENCES
CERT, U. (2018). Russian government cyber activity tar-
geting energy and other critical infrastructure sectors.
Us Cert, pages 1–19.
Intelligence, O. C. T. (2016 (accessed August 28, 2020)).
STIX 2.0 Specification.
Ismail, Z., Leneutre, J., and Fourati, A. (2015). An at-
tack execution model for industrial control systems
security assessment. In Security of Industrial Control
Systems and Cyber Physical Systems, pages 157–167.
Springer.
Jin, X., Krishnan, R., and Sandhu, R. (2012). A unified
attribute-based access control model covering dac,
mac and rbac. In IFIP Annual Conference on Data
and Applications Security and Privacy, pages 41–55.
Springer.
Johnson, C., Badger, M., Waltermire, D., Snyder, J., and
Skorupka, C. (2016). Guide to cyber threat informa-
tion sharing. Technical report, National Institute of
Standards and Technology.
Johnson, C., Feldman, L., Witte, G., et al. (2017). Cyber-
threat intelligence and information sharing. Technical
report, National Institute of Standards and Technol-
ogy.
Martinelli, F., Osliak, O., and Saracino, A. (2018). Towards
general scheme for data sharing agreements empower-
ing privacy-preserving data analysis of structured cti.
In Computer Security, pages 192–212. Springer.
Masolo, C., Borgo, S., Gangemi, A., Guarino, N., Oltra-
mari, A., and Schneider, L. (2002). The wonderweb
library of foundational ontologies.
Oltramari, A., Vetere, G., Chiari, I., Jezek, E., Zanzotto,
F. M., Nissim, M., and Gangemi, A. (2013). Senso
comune: A collaborative knowledge resource for ital-
ian. In The People’s Web Meets NLP, pages 45–67.
Springer.
Osliak, O., Saracino, A., and Martinelli, F. (2019). A
scheme for the sticky policy representation supporting
secure cyber-threat intelligence analysis and sharing.
Information & Computer Security.
Ray, I. and Xin, T. (2004). Implementing real-time update
of access control policies. In Research Directions in
Data and Applications Security XVIII, pages 65–80.
Springer.
Sandhu, R. S. (1998). Role-based access control. In Ad-
vances in computers, volume 46, pages 237–286. El-
sevier.
Strom, B. E., Applebaum, A., Miller, D. P., Nickels, K. C.,
Pennington, A. G., and Thomas, C. B. (2018). Mitre
att&ck: Design and philosophy. Technical report.
Yang, K., Jia, X., Ren, K., Xie, R., and Huang, L. (2014).
Enabling efficient access control with dynamic policy
updating for big data in the cloud. In IEEE INFO-
COM 2014-IEEE Conference on Computer Commu-
nications, pages 2013–2021. IEEE.
Zhang, Y., Patwa, F., and Sandhu, R. (2015). Community-
based secure information and resource sharing in aws
public cloud. In 2015 IEEE Conference on Collab-
oration and Internet computing (CIC), pages 46–53.
IEEE.
ICISSP 2021 - 7th International Conference on Information Systems Security and Privacy
346