Role Mining in Business

The following sections are included:

• Preface

• Contents

The purpose of this part is to acquaint the reader with the prerequisite knowledge required to fully understand the content of this book. The first chapter starts with a brief overview of Identity and Access Management (IAM) systems, focusing on access control. The subsequent chapter describes the Role-Based Access Control (RBAC) model and other role-based concepts, followed by their formal description according to the ANSI/INCITS 359-2004 standard. In turn, we explain the way an organization can migrate from other access control models to RBAC through role engineering methodologies. The typical classification of the various role engineering approaches is presented. Role mining techniques, namely the automated part of role engineering, are also introduced. A typical role mining process is described, highlighting its related problems and solutions. For academic-oriented readers, we also offer the required mathematical formalism. In particular, we summarize a few concepts about binary matrices and graph theory, by showing the relationship with role mining.

The following sections are included:

• Challenges of Controlling Access

• Access Control Concepts
  • Policies, Models, and Mechanisms
  • Permissions, Operations, and Objects
  • Authentication and Authorization
  • User Life-Cycle Management and Provisioning
  • Overentitlement and Underentitlement

• Access Control Models
  • Access Control Lists
  • Discretionary Access Control
  • Mandatory Access Control
  • Attribute-Based Access Control

• Final Remarks

The following sections are included:

• RBAC Basics

• RBAC Standards
  • Core RBAC
  • Hierarchical RBAC
  • Static Separation of Duties (SSD) RBAC
  • Dynamic Separation of Duties (DSD) RBAC

• Advantages of RBAC
  • Efficient Policy Maintenance and Certification
  • Efficient Provisioning
  • Reduction in New Employee Downtime
  • Enhanced System Security
  • Enhanced Organizational Productivity

• Obstacles to Migrating to RBAC
  • Role Engineering
  • Migration Costs
  • Systems Structure and Interoperability
  • Product Acceptance and Comparison

• Final Remarks

The following sections are included:

• Modeling Roles

• Role Engineering Approaches
  • Top-Down
  • Bottom-Up

• Parts of a Role Engineering Task

• Guidelines

• Final Remarks

The following sections are included:

• Role Mining Steps

• Understanding Access Control Data

• Data Preparation

• Role Definition

• Final Remarks

The following sections are included:

• Formalization of the Role Mining Problem

• Graph-Based Approach
  • Graph Theory Basics
  • Role Mining and Graph-Related Problems

• Matrix-Based Approach
  • Role Mining and Binary Matrix Factorization
  • Pseudo-Roles
  • Relevance of Maximal Pseudo-Roles
  • Fast Computation of Maximal Pseudo-Roles

• Permission-Powerset Lattice
  • Posets, Lattices, Hasse Diagrams, and Graphs
  • Mapping Permission Patterns to Roles
  • Finding Redundancies

• Final Remarks

In this part we survey the state-of-the-art about pattern identification in users' entitlements. In particular, we show the relationship between roles and frequent itemset mining, clustering, subset enumeration, and other well-know data mining strategies. Besides “classical” data mining, we also describe how to efficiently enumerate interesting patterns via specific algorithms for role mining. Further, we report on several approaches to obtain a minimal set of roles, by also showing how to estimate the minimum number of roles required to cover all user-permission relationships. We demonstrate that the minimum number of roles is sharply concentrated around its expected value—this result can be applied, for example, to decide whether it is advisable to undertake the efforts to renew an RBAC state. In turn, we generalize the role-finding problem by offering a cost-based approach that seeks to minimize the overall administration complexity of RBAC systems.

The following sections are included:

• Eliciting Patterns From Access Data
  • Clustering Techniques
  • Frequent Itemsets

• Minimizing the Number of Roles
  • A Graph Reduction for Role Minimization
  • Optimal Boolean Matrix Decomposition

• Estimating the Minimum Number of Roles
  • Martingales and Azuma-Hoeffding Inequality
  • A Concentration Result for Number of Roles
  • Applications of the Bound

• Final Remarks

The following sections are included:

• A Cost-Driven Approach to Role Engineering

• Problem Formalization

• Finding Optimal Role-Sets
  • Discarding Candidate Roles
  • Finding the Optimum

• Finding Sub-Optimal Role-Sets
  • Lattice Generation
  • Removing Costly Roles
  • Examples
  • Testing With Real Data

• Final Remarks

This part copes with the problem of assigning a business meaning to roles. To this aim, different approaches are proposed. First, we introduce a metric to assess how “good” are roles from a business perspective. The key observation is that a role is likely to be meaningful from a business perspective when it involves activities within the same business process or organizational units within the same branch. Second, a novel approach referred to as visual role mining is also delineated. The key idea is that of adopting a visual representation of existing user-permission assignments, hence allowing for a quick analysis and elicitation of meaningful roles. We propose a few algorithms that seek to best represent user-permission relationships.

The following sections are included:

• Meaningful Roles

• Modeling Business
  • Business Activities
  • Organization Units

• Measuring the Meaning of Roles
  • Farness
  • Activity-Spread
  • Organization-Unit-Spread
  • Revising the Cost Function

• Spread Indices in Action
  • Example of Activity-Spread
  • Organization-Unit-Spread on Real Data

• Final Remarks

The following sections are included:

• Role Visualization Problem
  • Binary Matrix Representation
  • Problem Formalization

• Matrix Sorting Algorithm
  • Algorithm Description
  • Example

• Visual Elicitation of Roles
  • Using Pseudo-Roles
  • Example

• A Visual Approach to Role Engineering

• Experimental Results

• Final Remarks

In this part we address the problem of reducing the role mining complexity in RBAC systems. As a first contribution, we describe some indices that measure the level of complexity involved in identifying subsets of users that share the same permissions. Hence, allowing for a business-driven divide-and-conquer approach to role mining. Next, we describe how to identify those exceptional assignments (i.e., permissions exceptionally or accidentally granted or denied) which badly bias any role mining analysis. We propose a methodology to restrict the role-finding problem to user-permission assignments that lead to the elicitation of stable candidate roles, by contextually simplifying the role selection task. In case the analyzed access control system admits of missing user-permission assignments, this part also describes how to impute such missing values in a very efficient and effective way.

The following sections are included:

• A Divide-and-Conquer Approach

• Complexity Measures

• Similarity
  • Similarity and Jaccard Coefficient
  • Approximating the Similarity

• Minability
  • Clustering Coefficient
  • The Minability Index
  • Approximating the Minability

• Considerations About Minability and Similarity

• Conditioned Indices
  • Conditioned Similarity
  • Conditioned Minability
  • Examples
  • Approximation of Conditioned Indices

• Application to a Real Case
  • High and Low Values of Minability and Similarity
  • Selection of the Best Business Information
  • Drill Down

• Final Remarks

The following sections are included:

• Stable Assignments and Stable Roles
  • Problem Formalization

• Pruning Unstable Assignments
  • Methodology
  • Unstable Assignment Identification

• Stability and Mining Complexity

• Pruning Examples
  • A Real Case
  • Effects of the Pruning on the Mining Complexity
  • Threshold Tuning

• Final Remarks

The following sections are included:

• Missing Values

• Algorithm Description

• 
  • Testing on Synthetic Data
  • Testing on Real Data

• Final Remarks

The last topic of this book is represented by the analysis of the risk derived from granting access to resources, and how RBAC allows to effectively manage such a risk. We point out that existing role mining techniques are not able to elicit roles with an associated clear business meaning. Hence, it is difficult to mitigate risk, to simplify business governance, and to ensure compliance throughout the enterprise. To elicit meaningful roles, we recall the methodology described in Chap. 8 where data to analyze are decomposed into smaller subsets according to the provided business information. We show how this leads to a decrease in the likelihood of making errors in role management, and consequently reduces the risk of role misuse. Additionally, we introduce an approach to highlight users and permissions that markedly deviate from others, and that might consequently be prone to error when roles are operating. By focusing on such users and permissions during the role definition process, it is possible to mitigate the risk of unauthorized accesses and role misuse.

The following sections are included:

• Assessing Risky System Configurations

• Risk Model

• Risk Metrics
  • Similarity- and Minability-Based Risks
  • Conditioned Indices
  • Fast Index Approximation

• Analysis of a Real Case

• Final Remarks

The following sections are included:

• Stability

• Framework Description

• Experimental Results

• Final Remarks

The following sections are included:

• Bibliography

• Index