Extended Authorization Policy for Graph-Structured Data

The high increase in the use of graph databases also for business- and privacy-critical applications demands for a sophisticated, flexible, fine-grained authorization and access control (AC) approach. Attribute-based access control (ABAC) supports a fine-grained definition of authorization rules and policies. Attributes can be associated with the subject, the requested resource and action, but also the environment. Thus, this is a promising starting point. However, specific characteristics of graph-structured data, such as attributes on vertices and edges along a path from a given subject to the resource to be accessed, are not yet considered. The well-established eXtensible Access Control Markup Language (XACML), which defines a declarative language for fine-grained, attribute-based authorization policies, is the basis for our proposed approach—XACML for Graph-structured data (XACML4G). The additional path-specific constraints, described in graph patterns, demand for specialized processing of the rules and policies as well as adapted enforcement and decision-making in the access control process. To demonstrate XACML4G and its enforcement process, we present a scenario from the university domain. Due to the project’s environment, the prototype is built with the multi-model database ArangoDB. Finally, compliance of XACML4G with quality standards for access control systems administration and enforcement is assessed. The results are promising and further studies concerning performance and use in practice are planned.

CSPM- Cloud Security Posture Management (Comprehensive Security for Cloud Environment)

As enterprises place more services in public cloud and as the public cloud providers introduce more infrastructure and platform services directly into the hands of developers, it is becoming increasingly complex and time-consuming to answer the seemingly straightforward question “Are we using these services securely?” and “Does the configuration of my cloud services represent excessive risk?” For example, manually assessing the secure setup and configuration in cloud environments across different services, each with varying granularities of authorization policies, is extremely difficult, if not impossible. Simple misconfiguration issues (such as open storage buckets) represent significant risk (see “Open File Shares Are Your Biggest Cloud Security Problem”) and occur often, as evidenced by continuing publicized data disclosures from publicly exposed storage buckets.