Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on access control system and on analysis tools for reasoning on it. In A.C. system based on policy, think about XACML specifications, the overall behaviour of the system cannot be clearly predict in case of multiple policies, also maybe conflicting.

Thus, my question is, from a developer side or a security system engineer, which are the main features that an analysis tool must have to help policy developing?

There are many example about change-impact analysis, properties verification, ..., but many of them seems to not be used in real application. Which are the real needs of security professionals?

share|improve this question
How does security theater play into this? – Steve Sep 24 '13 at 16:15
Nothing, my fault, sorry. – andrex_jux Sep 24 '13 at 21:32
up vote 1 down vote accepted

The magic word is RSOP = Resultant Set Of Policy.

Any useful tool tool should show

  • what the result of all policies are together (as if it was a single policy),
  • which policies took precedence and why, and
  • which did not take effect/were overridden by other policies and why,
  • Any policies which were corrupt or otherwise meaningless.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.