Pressures are increasing on organisations to take an early and more systematic approach to security. A key to enforcing security is to restrict access to valuable assets. We regard access policies as security requirements that specify such restrictions. Current requirements engineering methods are generally inadequate for eliciting and analysing these types of requirements, because they do not allow complex organisational structures and procedures that underlie policies to be represented adequately. This paper discusses roles and why they are important in the analysis of security. The paper relates roles to organisational theory and how they could be employed to define access policies. A framework is presented, based on these concepts, for analysing access policies. Keywords: access policies, security requirements, roles. There is increasing recognition of the importance of requirements engineering (RE) in the formulation and analysis of security policies [1] . The term policy is broad but can be interpreted as a rule, which may be of a procedural or technical nature, and is formulated to satisfy a goal. In this paper we focus on policies for data access and how the rules by which data should be accessed can be expressed. Access is controlled by allocating permissions to users, allowing them to access particular information only. In order to specify access control requirements, an understanding of organisational structures and procedures is needed [12] . While some RE methods incorporate notions of actors or agents, they do not explicitly allow relating actors to organisational groups or modelling of authority, both of which are keys to identifying responsibilities of users with respect to the information assets that are to be protected. The ideas presented in this paper have emerged from a project within the Security Requirements Group at the Open University. The objectives of this work are to: 1. Identify concepts and organisational principles that underlie access restrictions and authorisation procedures. 2. Develop an analytical framework based on the above concepts for specifying and analysing these types of requirements. 3. Explore how this framework could be integrated into existing RE methods such as goal-based analysis. 4. Validate the framework with a set of case studies, either using real life projects or analysing case studies from the literature. In this paper, we report on the outcome of the first two objectives. The paper is organised as follows. In section 2 we discuss the importance of roles for analysing security goals and policies, the weaknesses of current RE methods, and examine contributions from the policy and access control research community as to how roles can be used to formulate access policies. In section 3 we relate this research to organisational theory, and identify categories of roles and how they may be derived from an organisational structure. In section 4 we introduce a framework for specifying and analysing role-based access restrictions, which includes a graphical notation, and illustrate its use on a healthcare example. We conclude the paper with a short summary and a discussion of future work. 1 Robert Crook is also an independent consultant.
Another work in the same direction has been presented by Crook et al. REF who propose a framework for defining access control policies which considers the assignment of users to the roles within an organization.
Modelling Access Policies using Roles in Requirements Engineering
Information and Software Technology (Elsevier
Computer Science