Acumen: Analysing the Impact of Organisational Change on Users’ Access Entitlements

Abstract

Planned organisational changes are frequent occurrences in large enterprises due to the dynamicity of employees’ roles, evolution of teams, units and divisions as a result of mergers, demergers, and general restructuring. To safeguard system security and employees’ productivity, it is paramount for system administrators to keep track and remediate all users’ changing access needs. This paper studies the impact of (planned) organisational changes on the access privileges of employees in line with access control policies. Our solution, Acumen, uses binary decision diagrams (BDDs) to encode XACML policies via a Boolean function conversion, and performs semantic interpretation of organisational changes for analysis over the BDDs. The BDD structure is versatile, enabling succinct representation as well as effective and efficient symbolic operations and visualisation. We demonstrate the efficacy of Acumen with two data sets via a series of case studies on: a) a commonly used benchmark access control policy data in the literature; and b) a proprietary data set containing planned organisational changes in a large real-world financial institution with a dynamic business environment. The empirically results show Acumen to be effective and efficient.

S. Kwashie, W. Kang, and S. Santhosh Kumar—Equal contributions.

Appendices

A Distribution of Entitlements and Its Implications

Here, we present a t-SNE plot to illustrate the distribution of entitlements in high dimensional user-profile feature space; and discuss its implications and the necessity for automated change analysis.

Fig. 7.

A t-SNE plot of entitlements.

Figure 7 is generated using 20% of randomly selected samples from DS1. It has over 837K dots (with overlapping) which seem to be randomly and evenly distributed in a sphere, where each dot is an entitlement instance and the colours represent the entitlement IDs. Among the 837K entitlement instances, there are over 60K unique entitlements – as one entitlement can be assigned to multiple subjects (e.g., users). Clearly, dots with dark colours dominate, meaning that the entitlements with smaller IDs are assigned much more frequently. According to our distribution analysis, the first 270 entitlements accounts for 50% of the total instances, and the first 5000 entitlements 75%. As the most common 270 entitlements appear in half of the instances, on average each of these entitlements will be assigned to roughly 1550 users. Thus, a single organisational change can affect the profiles of users, and consequently the access of an average of 1550 users can be impacted, rendering manual maintenance of access entitlements and analysis of change impact infeasible.

B The Project Management Policy: A Case Study

DS2 is an ABAC policy data for a project management system used in [25]. However, the access control rules are not strictly represented using attribute expressions in the form of $a \vartriangleright v$ as we do in this work. Thus, we transformed the rules into their attribute expression equivalent so that they can be analysed by our algorithms. We refer interested readers to [25] for the complete dataset.

1.1 B.1 Policy Rules, Users and Resource Data

The original DS2 consists of 11 policies. For ease of comprehension, we use a single policy from the set for this discussion. The chosen policy’s tenet in natural language format as they appear in [25] states: “an employee working on a project can read and request to work on any task whose required areas of expertise are among his/her areas of expertise”.

We represent this policy by a set of eight rules, using the attribute expression in Sect. 2.1. Snippets of relevant users attribute data and resource attribute data in Tables 6 and 7 respectively, that support our discussion.

Table 6. Users Attribute Data: Technical Workers – Proj11

Table 7. Resources Attribute Data: Proj11 Tasks

1.2 B.2 Change BDD

The BDD to support the case study in Sect. 6.3 is presented in Fig. 8. In Fig. 8(b), we can see two roots. The subgraph rooted at node @-​1 captures the change BDD for rules changing from not applicable to applicable. On the other hand, the other subgraph rooted at @13 shows the change BDD capturing rules impacted from applicable to not applicable. To find those rules, we search for all the paths connecting any number of the indicator nodes down to variable nodes that are connected with the terminal node with solid arrow(s). Then we can easily obtain the binary representations of the four impacted rule ids 4, 5, 6 and 7 by decoding the arrows in each path above and replacing the solid lined arrow ($\rightarrow$) with 1 and the dashed lined arrow ($\rightharpoonup$) with 0 respectively. Therefore, the entitlements related to rules 4, 5, 6 and 7 will be lost due to the change.

Fig. 8.

Change analysis using BDD