# Risk-Based Access Control Model: A Systematic Literature Review
## 6 Discussion
Using the context as a risk factor in risk-based access control models customizes the risk model to a specific application and adds the flexibility needed for these access control models to be able to adapt to their environment. Resource sensitivity and trust were adopted in 12 and 11 risk-based models, respectively. As a conclusion, determining the appropriate risk factors for building a risk-based access control model is significantly based on the application and environment where this model will be deployed. It also depends on the availability of data for such a risk factor to be able to use it to calculate the overall security risk value associated with the access request to determine the access decision. **RQ3: What are risk estimation techniques employed in risk-based access control models? **  
The vital stage of implementing a risk-based access control model is the risk estimation process. This process is based on estimating the likelihood of information leakage and the value of that \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Citation** & \begin{tabular}{c} **Benefits** \\ **of User** \\ \end{tabular} & \begin{tabular}{c} **Action** \\ **Severity** \\ \end{tabular} & \begin{tabular}{c} **Resource** \\ **Sensitivity** \\ \end{tabular} & \begin{tabular}{c} **Outcomes** \\ **ACTIONS** \\ \end{tabular} & \begin{tabular}{c} **Context** \\ \end{tabular} & \begin{tabular}{c} **Trust** \\ **History** \\ \end{tabular} & \
\begin{tabular}{c} **Risk** \\ **Policies** \\ \end{tabular} &
\begin{tabular}{c} **Access** \\ **Role** \\ \end{tabular} \\ \hline [PERSON] et al. [46] & - & - & - & - & \(\backslash\) & - & - & - & - & \(\backslash\) \\ \hline [PERSON] et al. [47] & - & - & - & - & - & - & \(\backslash\) & \(\backslash\) & - & - \\ \hline [PERSON] et al. [48] & - & - & - & - & - & - & - & - & \(\backslash\) \\ \hline [PERSON] et al. [13] & \(\backslash\)J & - & - & - & \(\backslash\) & - & \(\backslash\) & - & \(\backslash\) \\ \hline [PERSON] et al. [49] & - & - & - & - & - & \(\backslash\) & \(\backslash\) & - & - \\ \hline [PERSON] et al. [9] & - & \(\backslash\)V & \(\backslash\)J & - & \(\backslash\)V & - & \(\backslash\) & - & - \\ \hline [PERSON] and [PERSON] [50] & - & - & - & - & \(\backslash\) & - & - & - & - \\ \hline [PERSON] et al. [52] & - & - & - & - & - & \(\backslash\) & \(\backslash\) & - & - \\ \hline [PERSON] et al. [53] & - & - & \(\backslash\)J & \(\backslash\)J & - & \(\backslash\) & - & - & - \\ \hline [PERSON] et al. [54] & - & - & \(\backslash\)J & - & \(\backslash\)J & - & \(\backslash\) & - & - \\ \hline [PERSON] et al. [55] & - & \(\backslash\)J & - & - & \(\backslash\)J & - & \(\backslash\) & - & - \\ \hline [PERSON] et al. [56] & - & - & - & - & - & \(\backslash\) & \(\backslash\) & - & - \\ \hline [PERSON] and [PERSON] [57] & \(\backslash\)J & - & - & - & - & \(\backslash\) & - & - & \(\backslash\) \\ \hline \hline \end{tabular}
\end{table} 
Table 5: _Cont._  
Figure 7: Risk factors used to build risk-based access control models that are discussed in retrieved publications. information. The main purpose of the risk estimation process is to build a method to arrange risks based on their priorities and use risk values to make access decisions following a specific context. There are several challenges associated with the risk estimation process. For example, the key purpose of the risk estimation process is to forecast the future likelihood of information leakage and the impact of such leakage on system resources. Defining such a likelihood is not an easy job [60]. Moreover, if the risk estimation process is based on imprecise or incomplete information, it will result in complications and problems to identify the value of information [31]. Determining the suitable risk estimation technique for building a risk-based access control models is not an easy task, as there are many things that should be taken into consideration: for instance, the availability of data that describe the risk likelihood and its impact.