My paper of choice this time was "Role-Based Access Controls" by David F. Ferraiolo and D. Richard Kuhn. This paper deals with sharing and security models, how the separation of roles should look like. Since our project involves different groups, that may or may not overlap, separation of roles and groups will be essential.
As a provider, we should be concern about who can access what information from our service. As we will deal with customers, they expect confidentiality and privacy (protection) about their information and intellectual property, to the extent of applicable laws. Unauthorized disclosure can turn away users and raises a bad reputation for the developers. Maintaining appropriate data integrity, availability and confidentiality should be one of our main goals while developing software. Since we are planning to provide service for anybody who has access to augmented reality capable technology (eg.: smartphone or tablet), we will have a wide attack surface, and we will have a lot of users.
Creating a simple, yet efficient Role Based Access Control is a challenge. Since most of our users will only have to be grouped based on their preferences, the job is not that complicated. However, from the security standpoint, we have to pay particular attention, who can have higher privileges, and how group organizing functions will be realized. Also we have to note, that because of the many-to-many relationship between roles and individuals might result in some undesired or unexpected situations. The methodology described as the Principle of Least Privilege is very appealing and used widely in the industry: only grant as much privilege that is absolutely required to perform a specific job. Since our provided content does not have the traditional discrete "ownership" property, (it will belong to a specific group, not just to a person), understanding and enforcing appropriate group control policies will be key to maintain a pleasant user experience.
No comments:
Post a Comment