# Risk-Based Access Control Model: A Systematic Literature Review
## 6 Discussion
\begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt}} \hline \hline
**Citation** & **Summary of the Contributions of Each Publication** \\ \hline [PERSON] et al. [4] & This paper presented a risk-based model that is based on the Multi-Level Security (MLS) approach. The paper utilized the risk value resulted from the difference between object and subject security level as a risk factor. Then, the fuzzy logic system was applied to represent the risk as a binary value, where 0 allows the access and 1 denies the access. \\ \hline [PERSON] et al. [20] & This paper presented the main elements needed to build a dynamic and flexible risk-based access control model by collecting environmental information, assess it, and make the access decision using a risk assessment. \\ \hline [PERSON] et al. [34] & This paper used the same elements of the risk-based model proposed by [PERSON] et al. [20] but with the use of the fuzzy logic system to estimates the risk value associated with the access request. They indicated that the fuzzy logic system is an efficient method for evaluating the security risks of access control operations. The major difference between both publications was the risk estimation technique adopted to assess the security risk of each access request. \\ \hline [PERSON] et al. [28] & This paper provided a risk-based model by utilizing the risk assessment. The authors collected environmental and contextual information and assessed it based on outcomes of actions in term of CIA (Confidentiality, Integrity, and Availability). In addition, the MultiFactor Evaluation Process (MFEP) technique was utilized with the risk assessment to estimate the security risk value related to each access request to decide the access decision. \\ \hline [PERSON] and [PERSON] [50] & This paper proposed a risk-based model that employs the concept of “access first and verify later”; hence, the required information/data can be accessed immediately without delaying access. The paper also utilized semantics to build situation role hierarchies, which are used to assess the security risk to provide access decisions. \\ \hline [PERSON] et al. [32] & This paper proposed a Risk-Adaptable Access Control (RAdAC) model, which is based on estimating the security risk and operational needs to grant or deny access. This model was implemented to first estimate the risk associated with the access request then compares the estimated risk with the access control policy. After that, the system verifies the operational needs, if the associated operational needs and the policy are met; then, the access is granted. \\ \hline [PERSON] et al. [27] & This paper utilized the Risk-Adaptable Access Control (RAdAC) model developed by [PERSON] et al. [32] to identify different risk components with the operational needs using the Attribute-Based Access Control (ABAC) model. This paper integrated the ABAC model with the risk-based model to use other user attributes as risk factors. \\ \hline [PERSON] et al. [44] & This paper reviewed open problems in risk-based access control systems and proposed using market approaches to identify the risk allocation and tolerance for each organization. The paper utilized the simulation to show the advantages of risk-based access control that promote security and information sharing. \\ \hline [PERSON] et al. [46] & This paper presented a risk-based access control model and how it can overcome issues with uncertainty and time-varying security specifications. The paper utilized resource sensitivity as a probability distribution, security labels, and clearance level to estimate the risk using the fuzzy logic system in various real-world situations. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Summary of recent studies outlined risk-based access control models.