Search:
Computing and Library Services - delivering an inspiring information environment

Identification of irregularities and allocation suggestion of relative file system permissions

Parkinson, Simon and Crampton, Andrew (2016) Identification of irregularities and allocation suggestion of relative file system permissions. Journal of Information Security and Applications. ISSN 2214-2126 (In Press)

[img]
Preview
PDF - Accepted Version
Download (355kB) | Preview

Abstract

It is well established that file system permissions in large, multi-user environments can be audited to identify vulnerabilities with respect to what is regarded as standard practice. For example, identifying that a user has an elevated level of access to a system directory which is unnecessary and introduces a vulnerability. Similarly, the allocation of new file system permissions can be assigned following the same standard practices. On the contrary, and less well established, is the identification of potential vulnerabilities as well as the implementation of new permissions with respect to a system's current access control implementation. Such tasks are heavily reliant on expert interpretation. For example, the assigned relationship between users and groups, directories and their parents, and the allocation of permissions on file system resources all need to be carefully considered.

This paper presents the novel use of statistical analysis to establish independence and homogeneity in allocated file system permissions. This independence can be interpreted as potential anomalies in a system's implementation of access control. The paper then presents the use of instance-based learning to suggest the allocation of new permissions conforming to a system's current implementation structure. Following this, both of the presented techniques are then included in a tool for interacting with Microsoft's New Technology File System (NTFS) permissions. This involves experimental analysis on six different NTFS directory structures within different organisations. The effectiveness of the developed technique is then established through analysing the true positive and true negative values. The presented results demonstrate the potential of the proposed techniques for overcoming complexities with real-world file system administration

Item Type: Article
Subjects: Q Science > QA Mathematics > QA76 Computer software
Schools: School of Computing and Engineering > High-Performance Intelligent Computing > Planning, Autonomy and Representation of Knowledge
School of Computing and Engineering > High-Performance Intelligent Computing > Planning, Autonomy and Representation of Knowledge
Related URLs:
Depositing User: Simon Parkinson
Date Deposited: 11 May 2016 08:23
Last Modified: 11 May 2016 08:29
URI: http://eprints.hud.ac.uk/id/eprint/28232

Downloads

Downloads per month over past year

Repository Staff Only: item control page

View Item View Item

University of Huddersfield, Queensgate, Huddersfield, HD1 3DH Copyright and Disclaimer All rights reserved ©