# Presentation: 171263

## Privilege and Policy Management for Cyber Infrastructures

- Dennis Kafura
- Markus Lorch

- Support provided by:  	Commonwealth Security Information Center
- 		Fermi National Accelerator Laboratory
- 		IBM

## Organization

- Grand Challenges
- Problems
- Requirements
- PRIMA – a privilege-based approach
- Models
- Architecture/Mechanisms
- Research challenges
- Policy
- Obligations
- Enforcement
- Usability
- Relationship to I3P and Workshop Themes

## Grand Challenge Problems

- Societal infrastructures
- 	“Develop tools and principles that allow construction of
- 	large-scale systems for important societal applications that
- 	are highly trustworthy despite being attractive targets.”
- Dynamic, pervasive computing environments
- 	“For the dynamic, pervasive computing environments of
- 	the future, give computing end-users security they can
- 	understand and privacy they can control.

- From: CRA Workshop on “Grand Research Challenges in Information Security and Assurance,” November 2003.

## Cyber Infrastructure Requirements

| Grand Challenge  | Attribute | Requirement |
| --- | --- | --- |
| 	Societal infrastructures | large scale | distributed authority |
|  |  | distributed trust establishment |
|  | trustworthy | predictable |
|  |  | responsive to environment |
|    	Dynamic, pervasive computing environments | understandable | familiar paradigm |
|  |  | unified principle |
|  | controllable | restricted rights assignment |
|  |  | differential confidence |

## PRIMA Models

## PRIMA Properties

| Grand
 Challenge  | Attribute | Requirement | PRIMA Model Property |
| --- | --- | --- | --- |
| Societal 
infrastructure | large scale | distributed authority | PM: privilege creation and delegation |
|  |  | distributed trust
establishment | TM: user-centric trust
PM: direct privilege management |
|  | trustworthy | predictable | AM/PM: dynamic policy |
|  |  | responsive to
 environment | AM: adaptive policy |
| Dynamic, 
pervasive
computing
environments | understandable | familiar paradigm | PM: privilege concept |
|  |  | unified principle | PM: privilege concept |
|  | controllable | restricted rights
 assignment | PM: least privilege access |
|  |  | differential confidence | TM: incremental trust
PM: selective control of privileges |

## Privilege Structure

**Privilege Properties**
-  Fully associated
-  Directly applicable
-  Time limited
-  Externalized
-  Secure
-  Non-repudiation

**Implementation**
-  Container: X.509 Attribute Certificate
-  Privilege: XACML rule construct

## Enforcement Concepts

- Policy Enforcement Point (PEP) checks privileges for:
- Applicability (to resource and requestor)
- Validity (of time frame and signature)
- Authority (with respect to privilege management policy)
- All permissible privilege constitute a dynamic policy for a request
- Policy Decision Point (PDP):
- Makes coarse decision
- Adds obligations for PEP

## Dynamic Policy

## Obligations

- Additional constraints to an authorization decision
- If PEP cannot fulfill an obligation then it disallows access
- Obligation address the mismatch in level of detail between request and policies
- Obligations help in maintaining system state

## Research Challenges: Policy

- What can be adapted from software engineering research for policy:
- Testing
- Debugging
- Formal Analysis
- Requirements engineering
- Policy extensions
- Threat/environment aware

## Research Challenges: Obligations

- Granularity mismatch
- Too many rights to be externalized
- Partially addressed by dynamic policy
- With respect to the request
- Need to add restrictions finer-grained than request

## Research Challenges: Enforcement

- Evaluation of mechanisms
- Dynamic user accounts
- Virtual machine/sandboxing
- Service containers
- Model
- Distributing privileges to dynamically provision an execution environment, vs.
- Pre-provisioning an execution environment and distributing a privilege for it

## Research Challenges: Usability

- What are the right conceptual models?
- Privileges
- Roles
- Others? Several? Combinations?
- How can users manage their rights?
- P3P
- Shibboleth release policies
- Least-privilege control

## Addressing I3P and Workshop Themes

|  | Enterprise Security Management | Policy definition and management |
| --- | --- | --- |
|  | Trust among Distributed Autonomous Parties | PRIMA trust model
Least privilege access
Fully decentralized mechanisms |
|  | Discovery/Analysis of Security Properties and Vulnerabilities | Policy testing
Policy analysis using formal methods |
|  | Secure System and Network Response and Recovery | Threat-aware policies |
|  | Traceback, Identification, and Forensics | Privilege validation (signing, non-repudiation)
Obligations |
|  | Insider Threats | Separation of duties through privilege restrictions |
|  | Life-cycle Threats | Policy requirements engineering |
|  | Distributed Ad Hoc Trust/Multi-Level Trust | Privilege management
Secure execution environments |

**I3P Agenda**

**Workshop **
**Themes**