# A Framework for Attribute-Based Access Control in Processing Big Data with Multiple Sensitivities
## 2 Materials and Methods
### Cybersecurity Vulnerability Evaluation  
In formulating the prototype experiment as part of our framework, we identified cybersecurity vulnerabilities in BDP technologies specific to Apache Hadoop. This informs residual attack surface evaluation. Techniques used to attack AC systems are identified using the Adversarial Tactics, Techniques, and Common Knowledge (ATT&CKtm) ([[https://attack.mitre.org/](https://attack.mitre.org/)]([https://attack.mitre.org/](https://attack.mitre.org/)) accessed 14 January 2023) knowledge base, as listed in Table 2. These tactics are based upon actual computer and network attacks documented by the industry and confirmed by MITRE. The Cloud Security Alliance also reports on attack strategies for big data systems and proposes mitigation techniques. Big data set breaches have been reported in several news sources and are anticipated to continue [43; 44; 45]. Approximately twelve Common Vulnerabilities and Exposures (CVEs) ([[https://hadoop.apache.org/cve_list.html](https://hadoop.apache.org/cve_list.html)]([https://hadoop.apache.org/cve_list.html](https://hadoop.apache.org/cve_list.html)) accessed 14 January 2023 ) are identified on the Apache Hadoop site. The total number on the CVE ([[https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=hadoop](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=hadoop)]([https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=hadoop](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=hadoop)) accessed 14 January 2023) site is approximately 45. The number of CVEs is higher because this list also includes items that are closed and not actively being addressed. The list provides a detailed description of attack paths that could be taken to compromise the system, such as the location of sensitive information in temporary files, privilege escalation, security values handling issues, and command injection. Most corrections to address the CVEs require upgrading to a later version of Hadoop. Security vulnerabilities for all the ecosystem components are also contained in the Hadoop issues tracking system, JIRA. A search for security-related issues in just HDFS and YARN results in over 500 open items. These technical details provide significant insights for specific potential attack paths. Although there are several security standards to guide the implementation of AC, ABAC, and other related authorization security services, few are implemented in the Apache Hadoop ecosystem components. Kerberos and SASL are used for identification, and SSL can be invoked on HTTP and RPC connections. However, neither XACML nor NGAC are addressed in Apache Ranger ([[https://issues.apache.org/jira/browse/RANGER-1973](https://issues.apache.org/jira/browse/RANGER-1973)]([https://issues.apache.org/jira/browse/RANGER-1973](https://issues.apache.org/jira/browse/RANGER-1973)) accessed 14 January 2023) or other Hadoop components. This could indicate that there is a lack of maturity in the open-source project to support sophisticated AC methods such as ABAC. A summary of the analyzed potential attacks is listed in Table 3, and further explained in the subsequent subsections. The vulnerabilities represent paths of entry into the system and include unsecured communication protocols, open connections, and configurations that can be exploited. Cybersecurity attacks are an example of attacker actions and campaigns that have exploited these vulnerabilities. The attack campaigns are known frameworks and libraries of exploitation tools, such as Metasploit, Cobalt Strike, and others detailed on