Closed-loop design of access control policies based on risk analyses

Qualitative security policy design methods suffer from over-reliance on expertise. This paper presents an access control method based on the risk analyses and feedback control in a closed loop design method. In this method, the business process turnover time is used as the security risk measurement basis, with the risk as security state variables in information systems. The relationship between the risk and the business process elements is used as the feedback control of the access control policy. This feedback control model analyzes the access control policies for a single business process independent of the expertise. The system security state variables can be driven into the desired range depending on the model, and at the same time, the established security policy priority ensures the appropriate security policies.EI0SUPPL. 11590-15965