Abstract:A security policy states the acceptable actions of an information system, as the actions bear on security. There is a pressing need for organizations to declare their security policies, even informal statements would be better than the current practice. But, formal policy statements are preferable to support (1) reasoning about policies, e.g., for consistency and completeness, (2) automated enforcement of the policy, e.g., using wrappers around legacy systems or after the fact with an intrusion detection system, and (3) other formal manipulation of policies, e.g., the composition of policies. We present LaSCO, the Language for Security Constraints on Objects, in which a policy consists of two parts: the domain (assumptions about the system) and the requirement (what is allowed assuming the domain is satisfied). Thus policies defined in LaSCO have the appearance of conditional access control statements. LaSCO policies are specified as expressions in logic and as directed graphs, giving a visual view of policy. LaSCO has a simple semantics in first order logic (which we provide), thus permitting policies we write, even for complex policies, to be very perspicuous. LaSCO has syntax to express many of the situations we have found to be useful on policies or, more interesting, the composition of policies. LaSCO has an object-oriented structure, permitting it to be useful to describe policies on the objects and methods of an application written in an object-oriented language, in addition to the traditional policies on operating system objects. A LaSCO specification can be automatically translated into executable code that checks an invocation of a program with respect to a policy. The implementation of LaSCO is in Java, and generates wrappers to check Java programs with respect to a policy.

Checking Security Policy Compliance

Checking security compliance between models and code

Ontology Based Modeling for Information Security Management

System Security Assurance: A Systematic Literature Review

A Formal Model of Security Controls' Capabilities and Its Applications to Policy Refinement and Incident Management

Enforcing Business Rules and Information Security Policies through Compliance Audits; XISSF - A Compliance Specification Mechanism

Security Policy Consistency

Stateless and Rule-Based Verification For Compliance Checking Applications

Towards Automated Continuous Security Compliance

Towards a Formal Framework for Partial Compliance of Business Processes

An operational model of security policies in Service-Oriented Applications

SoK: Access Control Policy Generation from High-level Natural Language Requirements

Conformance Checking of Access Control Policies Specified in XACML

A Security Assurance Framework Combining Formal Verification and Security Functional Testing

Semantic Matching of Security Policies to Support Security Experts

An Automatic Compliance Checking Approach for Software Processes

How to Integrate Security Compliance Requirements with Agile Software Engineering at Scale?

Security Policy Specification Using a Graphical Approach

A Rigorous Framework for Specification, Analysis and Enforcement of Access Control Policies

Automated Extraction of Security Policies from Natural-Language Software Documents

Efficient Semantics-Based Compliance Checking Using LTL Formulae and Unfolding.